Play interactive tour

Edit tour

Windows Analysis Report FedEx TRACKING DETAILS.exe

Overview

General Information

Sample Name:	FedEx TRACKING DETAILS.exe
Analysis ID:	532861
MD5:	32414d4cae15c3a8063bf1251346533c
SHA1:	3e92cca40b5b3bde11265ea773e77e0cd2432f96
SHA256:	d6b4f7ba99b492e9b2382b51f6c49b32e86cc81b7fc6c93313f5962de4b910bd
Tags:	exeFedExFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Writes to foreign memory regions

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

AV process strings found (often used to terminate AV products)

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

FedEx TRACKING DETAILS.exe (PID: 6348 cmdline: "C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe" MD5: 32414D4CAE15C3A8063BF1251346533C)

logagent.exe (PID: 3144 cmdline: C:\Windows\System32\logagent.exe MD5: E2036AC444AB4AD91EECC1A80FF7212F)

WerFault.exe (PID: 4848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.hdetpnipa.xyz/a34b/"], "decoy": ["mesonarte.com", "eksiwakun9.xyz", "dustcollectionconsultant.com", "heliosarchitecture.com", "chinaanalysisgroup.com", "nimbinhillshemp.com", "ychain.biz", "mountshastaart.com", "monstermangoloco.com", "bodhiandbear.com", "rootednft.xyz", "metayema.com", "zw21.xyz", "criccketworld.com", "segurobarato.net", "ananyacap.com", "momo-momo.xyz", "ezrealestatedeals.com", "ghrde.xyz", "idimol.com", "pcthspoe.xyz", "thewhiteswanharringworth.com", "che8760.com", "85111280.xyz", "apteka-magnolia.com", "proach.online", "portfolioabeckford.com", "affilinvest.com", "subspank.xyz", "odessamadrecoffeehouse.com", "onetrade.biz", "tianfuhg.com", "kibtitalikeniwenti.com", "terriblearttours.com", "saudirelief.com", "metacourting.xyz", "kimera.blue", "mgpsfm.com", "metawzrd.com", "veahhiodl.xyz", "alimasurfhotel.com", "sirensandiego.com", "gd-hxgg.com", "aurorarift.com", "clingbee.com", "zettavisor2021.xyz", "gregoryryankramer.art", "robertsonfandc.com", "sociedadgeograficacafe.com", "emilyhkeefer.com", "v-hush.com", "judithtuttle.xyz", "itbrandlink.com", "carrybicycles.com", "storge-evolution.com", "socnhhpa.xyz", "victorzark.com", "ghettoguy.com", "redtruckguy.com", "jeanmariewallendorf.com", "ocpdtel.xyz", "democracies.online", "bw529twonineh5.world", "chinhdohuyenthoai.xyz"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.0.logagent.exe.725b0000.11.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.11.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.11.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.8.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.8.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.8.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.8.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.8.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.8.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.6c0000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.6c0000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.6c0000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.725b0000.3.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.725b0000.3.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.725b0000.3.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.7.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.7.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.7.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.725b0000.3.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.725b0000.3.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.725b0000.3.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.4.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.4.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.4.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.7.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.7.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.7.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.3.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.3.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.3.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.11.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.11.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.11.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.4.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.4.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.4.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.6c0000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.6c0000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.6c0000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 43 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.hdetpnipa.xyz/a34b/"], "decoy": ["mesonarte.com", "eksiwakun9.xyz", "dustcollectionconsultant.com", "heliosarchitecture.com", "chinaanalysisgroup.com", "nimbinhillshemp.com", "ychain.biz", "mountshastaart.com", "monstermangoloco.com", "bodhiandbear.com", "rootednft.xyz", "metayema.com", "zw21.xyz", "criccketworld.com", "segurobarato.net", "ananyacap.com", "momo-momo.xyz", "ezrealestatedeals.com", "ghrde.xyz", "idimol.com", "pcthspoe.xyz", "thewhiteswanharringworth.com", "che8760.com", "85111280.xyz", "apteka-magnolia.com", "proach.online", "portfolioabeckford.com", "affilinvest.com", "subspank.xyz", "odessamadrecoffeehouse.com", "onetrade.biz", "tianfuhg.com", "kibtitalikeniwenti.com", "terriblearttours.com", "saudirelief.com", "metacourting.xyz", "kimera.blue", "mgpsfm.com", "metawzrd.com", "veahhiodl.xyz", "alimasurfhotel.com", "sirensandiego.com", "gd-hxgg.com", "aurorarift.com", "clingbee.com", "zettavisor2021.xyz", "gregoryryankramer.art", "robertsonfandc.com", "sociedadgeograficacafe.com", "emilyhkeefer.com", "v-hush.com", "judithtuttle.xyz", "itbrandlink.com", "carrybicycles.com", "storge-evolution.com", "socnhhpa.xyz", "victorzark.com", "ghettoguy.com", "redtruckguy.com", "jeanmariewallendorf.com", "ocpdtel.xyz", "democracies.online", "bw529twonineh5.world", "chinhdohuyenthoai.xyz"]}

Multi AV Scanner detection for submitted file

Show sources

Source: FedEx TRACKING DETAILS.exe	Virustotal: Detection: 36%			Perma Link
Source: FedEx TRACKING DETAILS.exe	ReversingLabs: Detection: 51%

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

Antivirus detection for URL or domain

Show sources

Source: www.hdetpnipa.xyz/a34b/

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Show sources

Source: www.hdetpnipa.xyz/a34b/

Virustotal: Detection: 9%

Perma Link

Machine Learning detection for sample

Show sources

Source: FedEx TRACKING DETAILS.exe

Joe Sandbox ML: detected

Source: 1.3.FedEx TRACKING DETAILS.exe.26e1534.338.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.291.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1914.140.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0fb8.93.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c975c.64.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c95f8.303.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1104.107.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd434.350.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de008.143.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c53cc.145.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd954.118.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4014.184.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d858c.229.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb8c4.81.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1c44.353.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1348.39.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c45dc.85.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.11.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de3c4.151.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6ecc.218.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1104.108.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d421c.193.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4008.14.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd3f0.111.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb8c4.79.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2eac.171.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4014.182.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e2180.55.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0fb8.90.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e74.106.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5504.154.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d91b4.253.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.6c0000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e4008.202.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0fb8.321.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca2bc.309.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9ca8.51.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9494.258.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e130c.333.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9ca8.54.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd43c.356.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0fd0.47.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2c04.162.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc0b4.22.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26db95c.311.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c527c.138.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e70.99.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c11a0.61.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de3c4.148.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de758.159.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca1c8.15.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c93bc.50.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd3f4.7.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d3840.84.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ad4.238.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e4008.200.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dffc8.172.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9434.285.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de758.156.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2104.74.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dddf4.126.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d39ac.179.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dffc8.170.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd3f4.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e10e4.331.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb5dc.77.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccd98.322.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1804.49.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc5dc.318.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.298.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4160.25.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1914.139.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d421c.191.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.297.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1d94.192.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1804.52.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9e2c.299.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6d44.214.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9128.40.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1bb4.149.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9434.287.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd440.354.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c92b0.267.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0008.319.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c11a0.60.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd3f0.109.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2eac.168.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9c84.286.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c93bc.48.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.2.logagent.exe.725b0000.3.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c51a0.121.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d36c4.175.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d149c.117.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb6b8.20.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5040.115.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca2bc.310.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9acc.275.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9c84.289.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0008.317.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1d94.195.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6ecc.217.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ed4.245.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da3b4.68.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd1a0.340.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ddef4.132.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0fb8.323.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bee4c.18.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd954.116.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9128.38.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0cf0.33.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dc210.28.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d18b4.131.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc5dc.316.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d18b4.133.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5288.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccd98.320.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd08c.337.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d68d4.204.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd2b4.345.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d77e8.11.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1534.339.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca1c8.16.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cfffc.313.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6cd0.209.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1d74.66.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb6b8.21.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1094.327.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.0.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1348.41.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4d98.91.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d7438.222.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.2.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e3840.314.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1094.325.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd2dc.102.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.7.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1e24.155.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc0b4.24.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9b24.283.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0fd0.46.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6cd0.210.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bc0d0.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c51a0.122.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2ff0.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5278.130.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9dd4.295.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1c44.355.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bdfc0.13.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9b24.281.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d858c.230.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c527c.137.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5288.19.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd2b4.344.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1ad8.187.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e3840.315.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c95f8.305.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.293.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6618.181.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d99e8.268.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccf78.332.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dc210.26.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c45dc.86.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c53cc.147.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd43c.358.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6d44.212.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0008.87.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c903c.255.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cce68.324.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6178.173.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1ad8.185.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2278.78.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd1a0.342.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e70.97.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da00c.304.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d68d4.206.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0008.88.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bde24.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e130c.335.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de008.141.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd2dc.101.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.273.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0cf0.32.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4008.12.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4d98.89.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c975c.62.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d52a4.201.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c91ac.261.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d77e8.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c92b0.269.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd1dc.95.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d7438.220.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ad4.237.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dfbf8.166.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d17c8.124.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd440.352.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9494.256.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dfbf8.164.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb5dc.75.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8008.224.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dddf4.125.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6178.174.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2104.76.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1d74.63.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c91ac.262.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2278.80.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.3.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d36c4.176.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccf78.334.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ed4.246.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d39ac.180.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2ff0.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd1dc.92.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e175c.341.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.274.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.279.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9acc.277.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e10e4.329.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.6c0000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2c04.165.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e74.105.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0f64.36.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8008.226.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1e24.157.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9e2c.301.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d3840.83.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d99e8.270.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9dd4.292.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e2180.53.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1bb4.146.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d52a4.198.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5278.129.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5504.153.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d17c8.123.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd08c.336.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cce68.326.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4160.23.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c903c.257.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26db95c.312.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5040.113.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0f64.37.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ddef4.134.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd434.348.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d149c.114.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da00c.307.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.2.logagent.exe.6c0000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e175c.343.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da3b4.65.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.280.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d91b4.250.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6618.183.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: FedEx TRACKING DETAILS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source:	Binary string: wininet.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.377390699.000000000543C000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377407261.000000000543D000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: logagent.exe, logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000B.00000002.392961331.00000000032F2000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: logagent.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wsock32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.hdetpnipa.xyz/a34b/

Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312773374.00000000007F8000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.309668822.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WerFault.exe, 0000000B.00000002.393477883.0000000005410000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312773374.00000000007F8000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.309668822.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/C
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312794774.0000000000832000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/y4mPZtA9xPxqg1XkAX9-qUmR9UIvDv4jsOqvEGGW7e_sHrucIbMm3Gtnd2oRX03KcuO
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/y4mTGtN2XEyFxr4Fwg2GfGDYA-weizJsEgCfvnFlKm_xwhWQiYk4SVd3YN1FLBVj9kD
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/y4mwmaWo75uzUwtwpwSnt0PfQZClqYm-BqTi81xEEYBIo3hzrTU99nIAl5l4jRjpvu3
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312794774.0000000000832000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/B&resid=C34B41C1B35825CB%21140&authkey=AN9sEgEIgUt16GA
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=C34B41C1B35825CB&resid=C34B41C1B35825CB%21140&authkey=AN9sEgE

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: FedEx TRACKING DETAILS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Windows\SysWOW64\logagent.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048020A8
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474841F
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1002
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B090
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04730D20
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473F900
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04802D07
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474D5E0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04801D55
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048022AE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04756E30
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04802EF7
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04801FF1
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04802B28
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FDBD2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476EBB0

Source: C:\Windows\SysWOW64\logagent.exe

Code function: String function: 0473B150 appears 35 times

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047796E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779840 NtDelayExecution,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047798F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047798A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779560 NtWriteFile,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779540 NtReadFile,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779910 NtAdjustPrivilegesToken,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047795F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047799D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047795D0 NtClose,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047799A0 NtCreateSection,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A50 NtCreateFile,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779650 NtQueryValueKey,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A20 NtResumeThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A10 NtQuerySection,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047796D0 NtCreateKey,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477A770 NtOpenThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779760 NtOpenProcess,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779710 NtQueryInformationToken,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779FE0 NtCreateMutant,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047797A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779780 NtMapViewOfSection,

Source: FedEx TRACKING DETAILS.exe

Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Section loaded: amsiproxy.dll
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Section loaded: amsiproxy.dll

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page no access
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B1000 page read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725E0000 page read and write

Source: FedEx TRACKING DETAILS.exe	Virustotal: Detection: 36%
Source: FedEx TRACKING DETAILS.exe	ReversingLabs: Detection: 51%

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

File read: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Jump to behavior

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe "C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe"
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Windows\SysWOW64\logagent.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Ipknvfrclgulizdtylbxizfhvowtamb[1]

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC41.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/7@2/0

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3144

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source:	Binary string: wininet.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.377390699.000000000543C000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377407261.000000000543D000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: logagent.exe, logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000B.00000002.392961331.00000000032F2000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: logagent.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wsock32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Code function: 1_3_02641752 push edx; ret
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0478D0D1 push ecx; ret

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\SysWOW64\logagent.exe	RDTSC instruction interceptor: First address: 00000000006C9904 second address: 00000000006C990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\logagent.exe	RDTSC instruction interceptor: First address: 00000000006C9B7E second address: 00000000006C9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 7_2_04776DE6 rdtsc

Source: C:\Windows\SysWOW64\logagent.exe

Process information queried: ProcessInformation

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: WerFault.exe, 0000000B.00000002.393404168.00000000053F0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWx!B
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 0000000B.00000003.390796145.000000000540E000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000002.393477883.0000000005410000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.11.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 7_2_04776DE6 rdtsc

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04750050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04750050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04804015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04804015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047358EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047790AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04801074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04757D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048005AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048005AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04773D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047BA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047E8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047C41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04761DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04761DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04761DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047661A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047661A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047635A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04800EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04800EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04800EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FEA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047C4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04774A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04774A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04753A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04768E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04748A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047616E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047476E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04778EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047636CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04763B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04763B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04805BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04734F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04734F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047737F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04748794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762397 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04741B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04741B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047ED380 mov ecx, dword ptr fs:[00000030h]

Source: C:\Windows\SysWOW64\logagent.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\logagent.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 7_2_04779860 NtQuerySystemInformation,LdrInitializeThunk,

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 1D0000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 1E0000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 400000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 410000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 420000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 430000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 440000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 450000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 460000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 725B0000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 470000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 6B0000

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 725B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 1D0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 1E0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 410000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 420000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 430000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 440000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 450000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 460000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 470000 protect: page execute and read and write
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 6B0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Memory written: C:\Windows\SysWOW64\logagent.exe base: 725B0000 value starts with: 4D5A

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 1D0000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 420000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 460000
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 6B0000

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe

Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: Amcache.hve.11.dr, Amcache.hve.LOG1.11.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr, Amcache.hve.LOG1.11.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection412	Masquerading1	OS Credential Dumping	Security Software Discovery131	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Virtualization/Sandbox Evasion1	LSASS Memory	Virtualization/Sandbox Evasion1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection412	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	System Information Discovery11	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FedEx TRACKING DETAILS.exe	36%	Virustotal		Browse
FedEx TRACKING DETAILS.exe	52%	ReversingLabs	Win32.Backdoor.Androm
FedEx TRACKING DETAILS.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.3.FedEx TRACKING DETAILS.exe.26e1534.338.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c9508.291.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d1914.140.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d0fb8.93.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c975c.64.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c95f8.303.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d1104.107.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f189c.44.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d25fc.8.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd434.350.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de008.143.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c53cc.145.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dd954.118.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cce64.330.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d4014.184.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c7cb8.211.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d858c.229.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c5d74.167.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cb8c4.81.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e1c44.353.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e1348.39.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c62e4.178.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c45dc.85.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c88e4.227.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.0.logagent.exe.725b0000.11.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de3c4.151.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c6f60.197.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c88e0.231.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d6ecc.218.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b88.236.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d1104.108.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8dfc.35.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b84.239.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d421c.193.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e9e68.119.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c4008.14.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dd3f0.111.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cb8c4.79.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d2eac.171.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c7d7c.216.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d4014.182.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e2180.55.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d0fb8.90.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8ecc.251.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f4008.71.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ea4f8.290.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c4e74.106.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c5504.154.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b84.241.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26eaa28.308.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d91b4.253.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
7.0.logagent.exe.6c0000.8.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e4008.202.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e0fb8.321.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e42c4.27.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ca2bc.309.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9ca8.51.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9494.258.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d25fc.10.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e130c.333.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9ca8.54.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b88.235.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e1c2c.351.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd43c.356.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e90a8.247.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c0fd0.47.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f0008.196.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e42c4.30.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d2c04.162.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cc0b4.22.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9774.263.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26db95c.311.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c527c.138.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c4e70.99.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c11a0.61.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de3c4.148.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de758.159.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ca1c8.15.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c93bc.50.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd3f4.7.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dbffc.242.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d3840.84.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d8ad4.238.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e4008.200.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dffc8.172.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e9518.104.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f0008.194.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c9434.285.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de758.156.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c2104.74.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dddf4.126.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d39ac.179.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dffc8.170.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd3f4.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ef590.186.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ec37c.31.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e10e4.331.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cb5dc.77.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dbffc.240.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ea68c.58.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
www.hdetpnipa.xyz/a34b/	10%	Virustotal		Browse
www.hdetpnipa.xyz/a34b/	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
onedrive.live.com	unknown	unknown	false		high
3eie8a.sn.files.1drv.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.hdetpnipa.xyz/a34b/	true	10%, Virustotal, Browse Avira URL Cloud: phishing	low

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://3eie8a.sn.files.1drv.com/y4mTGtN2XEyFxr4Fwg2GfGDYA-weizJsEgCfvnFlKm_xwhWQiYk4SVd3YN1FLBVj9kD	FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp	false	high
https://onedrive.live.com/B&resid=C34B41C1B35825CB%21140&authkey=AN9sEgEIgUt16GA	FedEx TRACKING DETAILS.exe, 00000001.00000003.312794774.0000000000832000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	false	high
http://upx.sf.net	Amcache.hve.11.dr	false	high
http://schemas.xmlsoap.org/ws/2004/09/policy	WerFault.exe, 0000000B.00000002.393477883.0000000005410000.00000004.00000001.sdmp	false	high
https://onedrive.live.com/download?cid=C34B41C1B35825CB&resid=C34B41C1B35825CB%21140&authkey=AN9sEgE	FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	false	high
https://3eie8a.sn.files.1drv.com/y4mwmaWo75uzUwtwpwSnt0PfQZClqYm-BqTi81xEEYBIo3hzrTU99nIAl5l4jRjpvu3	FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	false	high
https://3eie8a.sn.files.1drv.com/	FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	false	high
https://3eie8a.sn.files.1drv.com/C	FedEx TRACKING DETAILS.exe, 00000001.00000003.312773374.00000000007F8000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.309668822.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	false	high
https://onedrive.live.com/	FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	false	high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532861
Start date:	02.12.2021
Start time:	19:01:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	FedEx TRACKING DETAILS.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/7@2/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 100% (good quality ratio 86.3%) Quality average: 71.1% Quality standard deviation: 33.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.107.42.13, 13.107.42.12, 52.168.117.173 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, onedsblobprdeus16.eastus.cloudapp.azure.com, sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-web-geo.onedrive.akadns.net, odc-sn-files-geo.onedrive.akadns.net, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, l-0004.l-msedge.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, odc-sn-files-brs.onedrive.akadns.net, l-0003.l-msedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:02:16	API Interceptor	1x Sleep call for process: FedEx TRACKING DETAILS.exe modified
19:02:55	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_logagent.exe_131232484c36b2f738ed9f8bca70746a5db0df_0357e9de_121e11bd\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7680010292392891
Encrypted:	false
SSDEEP:	96:CzpFyTUlstcneIb6oI7JfapXIQcQvc6QcEDMcw3DSDq+HbHgoC5AJkq+h88WpB8B:E5itcnDHBUZMXojFq/u7smS274ItQT
MD5:	419C342E2FF1D66525019CF8A7412F8A
SHA1:	2160A039CE1626B5C19985EDC43001DB18E3FA16
SHA-256:	CC9EF71255F0687FE00477DF292D7AD7A1EAE6DC7AB73CA1EA3BB0C8A5D47F52
SHA-512:	15D0C391C989975E35D065A76EFBD137EA2E1BF9CD7D73D5A5EF3D8E9B1B6CD4366993ACC51D55733544F0E4D35E84C6C40542E86AFD411B83BFEC8C6DD088B2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.9.7.4.1.6.9.8.1.9.9.7.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.9.7.4.1.7.3.8.8.2.4.5.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.e.1.2.7.f.d.4.-.7.f.d.a.-.4.d.3.8.-.9.1.f.9.-.9.4.c.2.9.5.0.c.b.3.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.e.e.5.a.1.6.-.f.b.0.4.-.4.e.a.9.-.9.2.d.a.-.e.0.8.2.3.a.8.6.f.8.a.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.g.a.g.e.n.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.l.o.g.a.g.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.4.8.-.0.0.0.1.-.0.0.1.c.-.c.e.f.5.-.3.2.3.7.f.2.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.8.d.c.4.a.2.6.c.e.8.7.e.b.d.d.a.8.2.4.7.e.4.2.b.1.5.6.c.a.9.b.4.c.0.b.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER124.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	3.695731414622114
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiOG6mqUm6YLM6+PgmfcLSaCprh89b2hsfo0Sm:RrlsNiX6NUm6YQ6Ggmf4Ss2afN
MD5:	063F7D56170385E625802CC652610447
SHA1:	0DC00C5627088CEB143EA2B7CFC1E9360E03353C
SHA-256:	3F12E53652B361A6A37801A732FEAFA0B4AE1BEE74BDA54AF1A2DC0327E9DDCD
SHA-512:	CE1BD71C0AED946C6CC27BF237053D6ADC383612DBC7C0D3C0370195DEB4F4929DB11A62AF904797D1FD5BACF5690BE30C15A7AAA706531AC9267AD07AA1D368
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.4.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AF.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	4.476819952907959
Encrypted:	false
SSDEEP:	48:cvIwSD8zsvJgtWI90aWSC8BS8fm8M4JemfZFmj+q86Gvx7Fcfrmrd:uITfRfbSNBJnyjox7Furmrd
MD5:	336F69F3EC0897593738A0A982C59B9A
SHA1:	76CED5ACBC0EC8D632735F57BCBB5B176717A888
SHA-256:	2DDA1DF2C6660E634F389EBC8F503484B9AF03A59D1009B4C52F2908DC75222B
SHA-512:	7D83AB3B3BAA5E6A9E77A3EFF41138907BFB850A078E09539625E2251E06E583C098693DA3205004010939A913CA0EF80974351802546FFC7068CDEF066570A7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1280893" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC41.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 3 03:02:50 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	47606
Entropy (8bit):	1.7988139734386561
Encrypted:	false
SSDEEP:	192:5GuBz473Be7zOWQ2ybM/ifHXsmao+2cf9YUni:E73B8qWQUivXsgcW
MD5:	5B0A9E1019955F0C1E419FAB47D191AE
SHA1:	B9C8571135C1A6A59BFC86323B6608C00F2F34AB
SHA-256:	45461A2551690183BD56F18FE4A1D8F2A3716D2B5CDBD49097EDD5AC9070A2EF
SHA-512:	8157CC2E4302FEB4729EDFB46DB854FAE2003CF80EC22FB469DD0866119811256A2B55D4BBB0598521792F464C443C263CA875D104DE1979C4E7A225309B2731
Malicious:	false
Reputation:	low
Preview:	MDMP....... .........a........................$...........$...*%..........T.......8...........T...............^............................................................................................U...........B......t.......GenuineIntelW...........T.......H.....a.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Ipknvfrclgulizdtylbxizfhvowtamb[1] Download File
Process:	C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe
File Type:	data
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	7.998000849555144
Encrypted:	true
SSDEEP:	6144:K728FG5e8FW+j7HoyEHTmcCknu7yB2A7X37dcVhPsBZ6Q/cnb1kTpm+BxOn:/1e8FW+j7Irqxkn+9AL37dokBZ6Tnb1p
MD5:	C4357B267D515956EA1CB9AED8413834
SHA1:	7DD659D3772D23142E9040D32057095A37123437
SHA-256:	D75F7B2470A35DFCE5AD17422908FD0C085776F3D252C4CAA855DFABF1136984
SHA-512:	51F9D250C71573E6C5CFCE0ADA38F04FE358FC64FB8EF417481BD90CC5D768F30DE418B08E4BDB5FEE955E80A21920B168643626FA30A86EA53B0A1CCCC74479
Malicious:	false
Reputation:	low
Preview:	...,y...Z.\..S....)....x..q...x..q..>...%....v.Z.....3....C..D...;...K..#..Z.L)...1.2kv.....5...+.p.F.9.WF.....!...x..q...x..q..>...%....v.Z.....3....C..D...;...K..#..Z.L)...1.2kv.....5...+.p.F.9.WF.....!...x..q...x..q..>...%....v.Z.....3....C.l.cK......Z......#......NBe_I./...Q....Y^.{:...6..=....t.....!.Dp...%.J."Y^.{:...6..=....t.....!.Dp...%.J..L>x.%..-..p.}L9..`.@aV.US.iWgz.&J..L>x.%..-..p.}L9..`.@aV.US.iWgz.&J..L>x.%..-..p.}L9..`.@aV.US.iWgz.&J+R.Y.\|..E3Zu.4.UjTx/V}.U...e.\|.E,..>.&.lTx-D.]...5N...C4..nXw..3M.Z.....>./....X6.....drm..~Y.;....u.\)"...-b.W...~\....k.i........i..E<...>..]...[..$.a.s...~...i..E<...>..]...[..$.a.s...~...i..E<...>..]...[..$.a.s...~...i..E<...>..]...[..$.a.s...Y....L...b".~....I.fK..8.....To....0s.]..........5G....}.........x.'m.}...nY....+c..J...Q..nY.y./V...m..w..u....._..{..>......l@..1Xi.S..\p<..e.(......&.....5A?3G.[.../U..)c.-Zo.5W... ..#v'v5Vx&.v/Q..Zv(..4.\u..i.....6.*.E9?3K.....P..\|..6......

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.277492162857272
Encrypted:	false
SSDEEP:	12288:15pAHpPpGqxnemhizybkiFOEZlxJw5qJfJa4gDXNTqYMd5LC4UzfYQ:vpAHpPpGqxnemhWT
MD5:	F5278E8C90C6CD7F46EEAEC5CA6492EF
SHA1:	1B088B8E770B36A14C898689C615B4FBDE3303F2
SHA-256:	0E6C371B3907EAD27B65988EC532B2B3C5D3F65CD2D76608BCA039C1F884215D
SHA-512:	09687E0F4152D0ED322F6D4A40B6155C077FCA5369A95F3EE112B46DA9E12D4FC7D7023647CAC1C4F3E1C8AE85FBA7D8CA3FF283CFB75F59DC8DE3D749CC3233
Malicious:	false
Reputation:	low
Preview:	regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm>..@.................................................................................................................................................................................................................................................................................................................................................G..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	4.02994997432179
Encrypted:	false
SSDEEP:	384:I9cs5Rftx1OPJ4X9seFnh7khPBqXeSeq5QMVyi6+/rl4Lk4TZd1DoXznqGUXvu:McaRftx10J4XaeFh7KBqXleq5QMVyi6L
MD5:	C5C36F93BAF245509167136DFF19024F
SHA1:	7EECA1040B8962D0DB6EB612A9AD9141DE8E9F5E
SHA-256:	BC1B85E63C38939BA308CF8C1BC6B7363434358957AC3DAA969A3438AA216C95
SHA-512:	0CED1208041C041C193F517701CF3FDBB554D352504DB2D5A455B3EF270BEA4DA4F1F5D392B311BE3C8349681A9AE779F073E9F9A61245F7BCDD93BE5DB6C108
Malicious:	false
Reputation:	low
Preview:	regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm>..@.................................................................................................................................................................................................................................................................................................................................................G..HvLE.^......Y....................{...S>.........0................... ..hbin................p.\..,..........nk,..u.@........ ........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..u.@........ ........................... .......Z.......................Root........lf......Root....nk ..u.@.....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.715076012164725
TrID:	Win32 Executable (generic) a (10002005/4) 90.87% Win32 Executable Borland Delphi 7 (665061/41) 6.04% Win32 Executable Borland Delphi 6 (262906/60) 2.39% InstallShield setup (43055/19) 0.39% Win32 Executable Delphi generic (14689/80) 0.13%
File name:	FedEx TRACKING DETAILS.exe
File size:	697856
MD5:	32414d4cae15c3a8063bf1251346533c
SHA1:	3e92cca40b5b3bde11265ea773e77e0cd2432f96
SHA256:	d6b4f7ba99b492e9b2382b51f6c49b32e86cc81b7fc6c93313f5962de4b910bd
SHA512:	a1af25aab065a83f5cac7a8ae89e9cae22a4014f2440f954773be0855950bb110aa28187da898b07dc795900d7181b1461541b29767fd45ab0336b3689ac6769
SSDEEP:	12288:CIEpAb3iVUYfqUe+L7JMlbv7fkgx8BcFcePyaW:CI8G3DYfq9+hMNTMK8Cbm
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3670910284e2d9b0

Static PE Info

General
Entrypoint:	0x45ac10
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	bbc9c0e1dd018627fbe5726a5fc2ba6c

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0045A9B8h
call 00007F1524E818C9h
nop
nop
nop
nop
nop
nop
mov eax, dword ptr [0045C2ECh]
mov eax, dword ptr [eax]
call 00007F1524ECD08Bh
mov ecx, dword ptr [0045C468h]
mov eax, dword ptr [0045C2ECh]
mov eax, dword ptr [eax]
mov edx, dword ptr [0045A768h]
call 00007F1524ECD08Bh
mov eax, dword ptr [0045C2ECh]
mov eax, dword ptr [eax]
call 00007F1524ECD0FFh
call 00007F1524E7F536h
nop
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5e000	0x210a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6a000	0x46600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x63000	0x636c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x62000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x59c5c	0x59e00	False	0.533007540855	data	6.54076370728	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
DATA	0x5b000	0x1480	0x1600	False	0.412642045455	data	3.98462224633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
BSS	0x5d000	0xda5	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x5e000	0x210a	0x2200	False	0.361443014706	data	4.94811291969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x61000	0x10	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x62000	0x18	0x200	False	0.05078125	data	0.199107517787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x63000	0x636c	0x6400	False	0.6420703125	data	6.6906267798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x6a000	0x46600	0x46600	False	0.417646120115	data	5.79742330784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x6b23c	0x134	data
RT_CURSOR	0x6b370	0x134	data
RT_CURSOR	0x6b4a4	0x134	data
RT_CURSOR	0x6b5d8	0x134	data
RT_CURSOR	0x6b70c	0x134	data
RT_CURSOR	0x6b840	0x134	data
RT_CURSOR	0x6b974	0x134	data
RT_BITMAP	0x6baa8	0x1d0	data
RT_BITMAP	0x6bc78	0x1e4	data
RT_BITMAP	0x6be5c	0x1d0	data
RT_BITMAP	0x6c02c	0x1d0	data
RT_BITMAP	0x6c1fc	0x1d0	data
RT_BITMAP	0x6c3cc	0x1d0	data
RT_BITMAP	0x6c59c	0x1d0	data
RT_BITMAP	0x6c76c	0x1d0	data
RT_BITMAP	0x6c93c	0x1d0	data
RT_BITMAP	0x6cb0c	0x1d0	data
RT_BITMAP	0x6ccdc	0x128	data
RT_BITMAP	0x6ce04	0x128	data
RT_BITMAP	0x6cf2c	0x128	data
RT_BITMAP	0x6d054	0xe8	data
RT_BITMAP	0x6d13c	0x128	data
RT_BITMAP	0x6d264	0x128	data
RT_BITMAP	0x6d38c	0xd0	data
RT_BITMAP	0x6d45c	0x128	data
RT_BITMAP	0x6d584	0x128	data
RT_BITMAP	0x6d6ac	0x128	data
RT_BITMAP	0x6d7d4	0x128	data
RT_BITMAP	0x6d8fc	0x128	data
RT_BITMAP	0x6da24	0xe8	data
RT_BITMAP	0x6db0c	0x128	data
RT_BITMAP	0x6dc34	0x128	data
RT_BITMAP	0x6dd5c	0xd0	data
RT_BITMAP	0x6de2c	0x128	data
RT_BITMAP	0x6df54	0x128	data
RT_BITMAP	0x6e07c	0x128	data
RT_BITMAP	0x6e1a4	0x128	data
RT_BITMAP	0x6e2cc	0x128	data
RT_BITMAP	0x6e3f4	0xe8	data
RT_BITMAP	0x6e4dc	0x128	data
RT_BITMAP	0x6e604	0x128	data
RT_BITMAP	0x6e72c	0xd0	data
RT_BITMAP	0x6e7fc	0x128	data
RT_BITMAP	0x6e924	0x128	data
RT_BITMAP	0x6ea4c	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6eb34	0x10a8	data	English	United States
RT_ICON	0x6fbdc	0x25a8	data	English	United States
RT_DIALOG	0x72184	0x52	data
RT_STRING	0x721d8	0x244	data
RT_STRING	0x7241c	0x1f0	data
RT_STRING	0x7260c	0x1c0	data
RT_STRING	0x727cc	0xdc	data
RT_STRING	0x728a8	0x2f4	data
RT_STRING	0x72b9c	0xdc	data
RT_STRING	0x72c78	0x10c	data
RT_STRING	0x72d84	0x33c	data
RT_STRING	0x730c0	0x3d4	data
RT_STRING	0x73494	0x3a4	data
RT_STRING	0x73838	0x3e8	data
RT_STRING	0x73c20	0xf4	data
RT_STRING	0x73d14	0xc4	data
RT_STRING	0x73dd8	0x2c0	data
RT_STRING	0x74098	0x478	data
RT_STRING	0x74510	0x3ac	data
RT_STRING	0x748bc	0x2d4	data
RT_RCDATA	0x74b90	0x10	data
RT_RCDATA	0x74ba0	0x310	data
RT_RCDATA	0x74eb0	0x3b5a8	GIF image data, version 89a, 744 x 119	English	United States
RT_GROUP_CURSOR	0xb0458	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb046c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb0480	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb0494	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb04a8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb04bc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb04d0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0xb04e4	0x22	data	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
advapi32	AuditFree
uRL	InetIsOffline

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2021 19:02:17.356704950 CET	52130	53	192.168.2.3	8.8.8.8
Dec 2, 2021 19:02:18.154975891 CET	55102	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 2, 2021 19:02:17.356704950 CET	192.168.2.3	8.8.8.8	0x7a68	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Dec 2, 2021 19:02:18.154975891 CET	192.168.2.3	8.8.8.8	0x6502	Standard query (0)	3eie8a.sn.files.1drv.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class
Dec 2, 2021 19:02:17.374954939 CET	8.8.8.8	192.168.2.3	0x7a68	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net	CNAME (Canonical name)	IN (0x0001)
Dec 2, 2021 19:02:18.199157953 CET	8.8.8.8	192.168.2.3	0x6502	No error (0)	3eie8a.sn.files.1drv.com	sn-files.fe.1drv.com	CNAME (Canonical name)	IN (0x0001)
Dec 2, 2021 19:02:18.199157953 CET	8.8.8.8	192.168.2.3	0x6502	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net	CNAME (Canonical name)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: FedEx TRACKING DETAILS.exe PID: 6348 Parent PID: 5308

General

Start time:	19:02:08
Start date:	02/12/2021
Path:	C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe"
Imagebase:	0x400000
File size:	697856 bytes
MD5 hash:	32414D4CAE15C3A8063BF1251346533C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Analysis Process: logagent.exe PID: 3144 Parent PID: 6348

General

Start time:	19:02:32
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\logagent.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\logagent.exe
Imagebase:	0x12e0000
File size:	86016 bytes
MD5 hash:	E2036AC444AB4AD91EECC1A80FF7212F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Analysis Process: WerFault.exe PID: 4848 Parent PID: 3144

General

Start time:	19:02:47
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368
Imagebase:	0x1250000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report FedEx TRACKING DETAILS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: FedEx TRACKING DETAILS.exe PID: 6348 Parent PID: 5308