Windows Analysis Report dxEOMYaOtV.exe

ID:	534013
Product:	CloudBasic
Start time:	00:29:26
Start date:	05.12.2021
Sample:	dxEOMYaOtV.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	a20a44e2add8f2ee2434258a20ac815e
SHA1:	bf2886c5bda80c2cc1a1a8d3d270f3e82f3f39b9
SHA256:	87b9a82fa05019692e89dc944a4fe1ab669d1c844abfd509c7e3648a024d4a73
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\app	UTF-8 Unicode (with BOM) text, with no line terminators	C6BDBC9D86009CCF7E8DE878C9603213	2A4B8716F978F2D107BCD8294B486A5EE45AFE6E	36A067FDFCEE95EB270F0B72E3B9E40D52C907D749FB9A8490D82F8EE56B29EB
\Device\ConDrv	ASCII text, with CRLF line terminators	689E2126A85BF55121488295EE068FA1	09BAAA253A49D80C18326DFBCA106551EBF22DD6	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25

AV Detection:

Found malware configuration

Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "3f0e7e396c4b65a76b6471f1f9d6d90a", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Host": "SoftwareMicrosoftWindowsCurrentVersionRun", "Port": "NDQz", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for submitted file

Source: dxEOMYaOtV.exe	Virustotal: Detection: 66%			Perma Link
Source: dxEOMYaOtV.exe	ReversingLabs: Detection: 92%

Yara detected Njrat

Source: Yara match	File source: dxEOMYaOtV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.656185698.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1183435675.00000000029B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dxEOMYaOtV.exe PID: 7008, type: MEMORYSTR

Antivirus / Scanner detection for submitted sample

Source: dxEOMYaOtV.exe

Avira: detected

Machine Learning detection for sample

Source: dxEOMYaOtV.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack	Avira: Label: TR/Dropper.Gen

Compliance:

Uses 32bit PE files

Source: dxEOMYaOtV.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: dxEOMYaOtV.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading:

Contains functionality to spread to USB devices (.Net source)

Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, Usb1.cs	.Net Code: infect
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, Usb1.cs	.Net Code: infect

May infect USB drives

Source: dxEOMYaOtV.exe	Binary or memory string: [autorun]
Source: dxEOMYaOtV.exe	Binary or memory string: \autorun.inf
Source: dxEOMYaOtV.exe	Binary or memory string: autorun.inf
Source: dxEOMYaOtV.exe, 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp	Binary or memory string: \autorun.inf
Source: dxEOMYaOtV.exe, 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp	Binary or memory string: [autorun]
Source: dxEOMYaOtV.exe, 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp	Binary or memory string: autorun.inf
Source: dxEOMYaOtV.exe	Binary or memory string: \autorun.inf
Source: dxEOMYaOtV.exe	Binary or memory string: [autorun]
Source: dxEOMYaOtV.exe	Binary or memory string: autorun.inf

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: SoftwareMicrosoftWindowsCurrentVersionRun

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63
Source: unknown	TCP traffic detected without corresponding DNS query: 109.123.118.63

URLs found in memory or binary data

Source: dxEOMYaOtV.exe, 00000000.00000002.1183036542.00000000009AB000.00000004.00000020.sdmp	String found in binary or memory: http://go.microsoft.
Source: dxEOMYaOtV.exe, 00000000.00000002.1183036542.00000000009AB000.00000004.00000020.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: dxEOMYaOtV.exe, 00000000.00000002.1183015023.000000000097A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud:

Yara detected Njrat

Source: Yara match	File source: dxEOMYaOtV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.656185698.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1183435675.00000000029B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dxEOMYaOtV.exe PID: 7008, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Source: dxEOMYaOtV.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: dxEOMYaOtV.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.656185698.00000000003B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Uses 32bit PE files

Source: dxEOMYaOtV.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: dxEOMYaOtV.exe, type: SAMPLE	Matched rule: MAL_Winnti_Sample_May18_1 date = 2018-05-04, hash1 = 528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41, author = Florian Roth, description = Detects malware sample from Burning Umbrella report - Generic Winnti Rule, reference = https://401trg.pw/burning-umbrella/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: dxEOMYaOtV.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: dxEOMYaOtV.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Winnti_Sample_May18_1 date = 2018-05-04, hash1 = 528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41, author = Florian Roth, description = Detects malware sample from Burning Umbrella report - Generic Winnti Rule, reference = https://401trg.pw/burning-umbrella/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Winnti_Sample_May18_1 date = 2018-05-04, hash1 = 528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41, author = Florian Roth, description = Detects malware sample from Burning Umbrella report - Generic Winnti Rule, reference = https://401trg.pw/burning-umbrella/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.656185698.00000000003B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Detected potential crypto function

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Code function: 0_2_00B72478		0_2_00B72478
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Code function: 0_2_04B64298		0_2_04B64298
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Code function: 0_2_04B6428F		0_2_04B6428F

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Process Stats: CPU usage > 98%

Sample file is different than original file name gathered from version info

Source: dxEOMYaOtV.exe, 00000000.00000002.1183015023.000000000097A000.00000004.00000020.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs dxEOMYaOtV.exe

Sample is known by Antivirus

Source: dxEOMYaOtV.exe	Virustotal: Detection: 66%
Source: dxEOMYaOtV.exe	ReversingLabs: Detection: 92%

PE file has an executable .text section and no other executable section

Source: dxEOMYaOtV.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\dxEOMYaOtV.exe "C:\Users\user\Desktop\dxEOMYaOtV.exe"
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\dxEOMYaOtV.exe" "dxEOMYaOtV.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\dxEOMYaOtV.exe" "dxEOMYaOtV.exe" ENABLE			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Code function: 0_2_052B23DE AdjustTokenPrivileges,		0_2_052B23DE
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Code function: 0_2_052B23A7 AdjustTokenPrivileges,		0_2_052B23A7

Creates files inside the user directory

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@4/2@0/1

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Creates mutexes

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Mutant created: \Sessions\1\BaseNamedObjects\3f0e7e396c4b65a76b6471f1f9d6d90a
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_01

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: dxEOMYaOtV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: dxEOMYaOtV.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Source: dxEOMYaOtV.exe, Stub/Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, Stub/Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, Stub/Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe TID: 7060	Thread sleep count: 1811 > 30			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe TID: 7060	Thread sleep time: -181100s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Window / User API: threadDelayed 1811			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Window / User API: foregroundWindowGot 997			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Window / User API: foregroundWindowGot 500			Jump to behavior
Source: C:\Users\user\Desktop\dxEOMYaOtV.exe	Window / User API: foregroundWindowGot 498			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: dxEOMYaOtV.exe, 00000000.00000002.1183036542.00000000009AB000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineOnly"/>

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Process token adjusted: Debug

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: dxEOMYaOtV.exe	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: dxEOMYaOtV.exe, 00000000.00000002.1183552920.0000000002A93000.00000004.00000001.sdmp, dxEOMYaOtV.exe, 00000000.00000002.1184101682.0000000004D0B000.00000004.00000010.sdmp, dxEOMYaOtV.exe, 00000000.00000002.1183969540.0000000002EA0000.00000004.00000001.sdmp, dxEOMYaOtV.exe, 00000000.00000002.1183435675.00000000029B1000.00000004.00000001.sdmp, dxEOMYaOtV.exe, 00000000.00000002.1183302082.0000000001080000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: dxEOMYaOtV.exe, 00000000.00000002.1184101682.0000000004D0B000.00000004.00000010.sdmp	Binary or memory string: C rdProgram Manager
Source: dxEOMYaOtV.exe	Binary or memory string: Shell_TrayWnd
Source: dxEOMYaOtV.exe	Binary or memory string: ProgMan
Source: dxEOMYaOtV.exe, 00000000.00000002.1183302082.0000000001080000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: dxEOMYaOtV.exe, 00000000.00000002.1183302082.0000000001080000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: dxEOMYaOtV.exe, 00000000.00000002.1183552920.0000000002A93000.00000004.00000001.sdmp, dxEOMYaOtV.exe, 00000000.00000002.1183969540.0000000002EA0000.00000004.00000001.sdmp, dxEOMYaOtV.exe, 00000000.00000002.1183435675.00000000029B1000.00000004.00000001.sdmp	Binary or memory string: qedProgram Manager
Source: dxEOMYaOtV.exe	Binary or memory string: Shell_traywnd

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query the account / user name

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Code function: 0_2_00B7A72E GetUserNameW,

0_2_00B7A72E

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\dxEOMYaOtV.exe" "dxEOMYaOtV.exe" ENABLE

Modifies the windows firewall

Source: C:\Users\user\Desktop\dxEOMYaOtV.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\dxEOMYaOtV.exe" "dxEOMYaOtV.exe" ENABLE

Stealing of Sensitive Information:

Yara detected Njrat

Source: Yara match	File source: dxEOMYaOtV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.656185698.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1183435675.00000000029B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dxEOMYaOtV.exe PID: 7008, type: MEMORYSTR

Remote Access Functionality:

Yara detected Njrat

Source: Yara match	File source: dxEOMYaOtV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dxEOMYaOtV.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1182843286.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.656185698.00000000003B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1183435675.00000000029B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dxEOMYaOtV.exe PID: 7008, type: MEMORYSTR