Edit tour

Windows Analysis Report
RFQ__637456464647.exe

Overview

General Information

Sample Name:	RFQ__637456464647.exe
Analysis ID:	632544
MD5:	b4bc907e8d48e8f09b4d9fdd8d416599
SHA1:	592a814a428c8a5de3f06245996fc775e8dc987f
SHA256:	7f7804a5460695dae61e378d733f0a613083e84c654ea6264a5276944b33f943
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Machine Learning detection for sample

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Yara detected Credential Stealer

Uses the system / local time for branch decision (may execute only at specific dates)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Checks if the current process is being debugged

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

RFQ__637456464647.exe (PID: 6312 cmdline: "C:\Users\user\Desktop\RFQ__637456464647.exe" MD5: B4BC907E8D48E8F09B4D9FDD8D416599)

RFQ__637456464647.exe (PID: 6400 cmdline: C:\Users\user\Desktop\RFQ__637456464647.exe MD5: B4BC907E8D48E8F09B4D9FDD8D416599)

chrome.exe (PID: 6672 cmdline: "C:\Users\user\AppData\Local\Temp\chrome.exe" MD5: 7F916511A313837EFCDE9E4112A64E5B)

WerFault.exe (PID: 7124 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 1296 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram Token": "Null!", "Telegram ID": "5164987354:AAFbwY5baNRyoCilWU25jL6nSQnU8yn8vuc"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x185d0:$x1: $%SMTPDV$ 0x17292:$x2: $#TheHashHere%& 0x18578:$x3: %FTPDV$ 0x17274:$x4: $%TelegramDv$ 0x14ba3:$x5: KeyLoggerEventArgs 0x14f39:$x5: KeyLoggerEventArgs 0x185fc:$m1: \| Snake Keylogger 0x186a2:$m1: \| Snake Keylogger 0x187f6:$m1: \| Snake Keylogger 0x1891c:$m1: \| Snake Keylogger 0x18a76:$m1: \| Snake Keylogger 0x1859c:$m2: Clipboard Logs ID 0x187ac:$m2: Screenshot Logs ID 0x188c0:$m2: keystroke Logs ID 0x18aac:$m3: SnakePW 0x18784:$m4: \SnakeKeylogger\
00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x185d0:$x1: $%SMTPDV$ 0x17292:$x2: $#TheHashHere%& 0x18578:$x3: %FTPDV$ 0x17274:$x4: $%TelegramDv$ 0x14ba3:$x5: KeyLoggerEventArgs 0x14f39:$x5: KeyLoggerEventArgs 0x185fc:$m1: \| Snake Keylogger 0x186a2:$m1: \| Snake Keylogger 0x187f6:$m1: \| Snake Keylogger 0x1891c:$m1: \| Snake Keylogger 0x18a76:$m1: \| Snake Keylogger 0x1859c:$m2: Clipboard Logs ID 0x187ac:$m2: Screenshot Logs ID 0x188c0:$m2: keystroke Logs ID 0x18aac:$m3: SnakePW 0x18784:$m4: \SnakeKeylogger\
00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x185d0:$x1: $%SMTPDV$ 0x17292:$x2: $#TheHashHere%& 0x18578:$x3: %FTPDV$ 0x17274:$x4: $%TelegramDv$ 0x14ba3:$x5: KeyLoggerEventArgs 0x14f39:$x5: KeyLoggerEventArgs 0x185fc:$m1: \| Snake Keylogger 0x186a2:$m1: \| Snake Keylogger 0x187f6:$m1: \| Snake Keylogger 0x1891c:$m1: \| Snake Keylogger 0x18a76:$m1: \| Snake Keylogger 0x1859c:$m2: Clipboard Logs ID 0x187ac:$m2: Screenshot Logs ID 0x188c0:$m2: keystroke Logs ID 0x18aac:$m3: SnakePW 0x18784:$m4: \SnakeKeylogger\
00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7d680:$x1: $%SMTPDV$ 0x7c342:$x2: $#TheHashHere%& 0x7d628:$x3: %FTPDV$ 0x7c324:$x4: $%TelegramDv$ 0x79c53:$x5: KeyLoggerEventArgs 0x79fe9:$x5: KeyLoggerEventArgs 0x7d6ac:$m1: \| Snake Keylogger 0x7d752:$m1: \| Snake Keylogger 0x7d8a6:$m1: \| Snake Keylogger 0x7d9cc:$m1: \| Snake Keylogger 0x7db26:$m1: \| Snake Keylogger 0x7d64c:$m2: Clipboard Logs ID 0x7d85c:$m2: Screenshot Logs ID 0x7d970:$m2: keystroke Logs ID 0x7db5c:$m3: SnakePW 0x7d834:$m4: \SnakeKeylogger\
00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7d680:$x1: $%SMTPDV$ 0x7c342:$x2: $#TheHashHere%& 0x7d628:$x3: %FTPDV$ 0x7c324:$x4: $%TelegramDv$ 0x79c53:$x5: KeyLoggerEventArgs 0x79fe9:$x5: KeyLoggerEventArgs 0x7d6ac:$m1: \| Snake Keylogger 0x7d752:$m1: \| Snake Keylogger 0x7d8a6:$m1: \| Snake Keylogger 0x7d9cc:$m1: \| Snake Keylogger 0x7db26:$m1: \| Snake Keylogger 0x7d64c:$m2: Clipboard Logs ID 0x7d85c:$m2: Screenshot Logs ID 0x7d970:$m2: keystroke Logs ID 0x7db5c:$m3: SnakePW 0x7d834:$m4: \SnakeKeylogger\
00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x185d0:$x1: $%SMTPDV$ 0x17292:$x2: $#TheHashHere%& 0x18578:$x3: %FTPDV$ 0x17274:$x4: $%TelegramDv$ 0x14ba3:$x5: KeyLoggerEventArgs 0x14f39:$x5: KeyLoggerEventArgs 0x185fc:$m1: \| Snake Keylogger 0x186a2:$m1: \| Snake Keylogger 0x187f6:$m1: \| Snake Keylogger 0x1891c:$m1: \| Snake Keylogger 0x18a76:$m1: \| Snake Keylogger 0x1859c:$m2: Clipboard Logs ID 0x187ac:$m2: Screenshot Logs ID 0x188c0:$m2: keystroke Logs ID 0x18aac:$m3: SnakePW 0x18784:$m4: \SnakeKeylogger\
00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x185d0:$x1: $%SMTPDV$ 0x17292:$x2: $#TheHashHere%& 0x18578:$x3: %FTPDV$ 0x17274:$x4: $%TelegramDv$ 0x14ba3:$x5: KeyLoggerEventArgs 0x14f39:$x5: KeyLoggerEventArgs 0x185fc:$m1: \| Snake Keylogger 0x186a2:$m1: \| Snake Keylogger 0x187f6:$m1: \| Snake Keylogger 0x1891c:$m1: \| Snake Keylogger 0x18a76:$m1: \| Snake Keylogger 0x1859c:$m2: Clipboard Logs ID 0x187ac:$m2: Screenshot Logs ID 0x188c0:$m2: keystroke Logs ID 0x18aac:$m3: SnakePW 0x18784:$m4: \SnakeKeylogger\
00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7d680:$x1: $%SMTPDV$ 0x7c342:$x2: $#TheHashHere%& 0x7d628:$x3: %FTPDV$ 0x7c324:$x4: $%TelegramDv$ 0x79c53:$x5: KeyLoggerEventArgs 0x79fe9:$x5: KeyLoggerEventArgs 0x7d6ac:$m1: \| Snake Keylogger 0x7d752:$m1: \| Snake Keylogger 0x7d8a6:$m1: \| Snake Keylogger 0x7d9cc:$m1: \| Snake Keylogger 0x7db26:$m1: \| Snake Keylogger 0x7d64c:$m2: Clipboard Logs ID 0x7d85c:$m2: Screenshot Logs ID 0x7d970:$m2: keystroke Logs ID 0x7db5c:$m3: SnakePW 0x7d834:$m4: \SnakeKeylogger\
00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7dab0:$x1: $%SMTPDV$ 0x7c772:$x2: $#TheHashHere%& 0x7da58:$x3: %FTPDV$ 0x7c754:$x4: $%TelegramDv$ 0x7a083:$x5: KeyLoggerEventArgs 0x7a419:$x5: KeyLoggerEventArgs 0x7dadc:$m1: \| Snake Keylogger 0x7db82:$m1: \| Snake Keylogger 0x7dcd6:$m1: \| Snake Keylogger 0x7ddfc:$m1: \| Snake Keylogger 0x7df56:$m1: \| Snake Keylogger 0x7da7c:$m2: Clipboard Logs ID 0x7dc8c:$m2: Screenshot Logs ID 0x7dda0:$m2: keystroke Logs ID 0x7df8c:$m3: SnakePW 0x7dc64:$m4: \SnakeKeylogger\
00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18ce0:$x1: $%SMTPDV$ 0x179a2:$x2: $#TheHashHere%& 0x18c88:$x3: %FTPDV$ 0x17984:$x4: $%TelegramDv$ 0x152b3:$x5: KeyLoggerEventArgs 0x15649:$x5: KeyLoggerEventArgs 0x18d0c:$m1: \| Snake Keylogger 0x18db2:$m1: \| Snake Keylogger 0x18f06:$m1: \| Snake Keylogger 0x1902c:$m1: \| Snake Keylogger 0x19186:$m1: \| Snake Keylogger 0x18cac:$m2: Clipboard Logs ID 0x18ebc:$m2: Screenshot Logs ID 0x18fd0:$m2: keystroke Logs ID 0x191bc:$m3: SnakePW 0x18e94:$m4: \SnakeKeylogger\
00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7dab0:$x1: $%SMTPDV$ 0x7c772:$x2: $#TheHashHere%& 0x7da58:$x3: %FTPDV$ 0x7c754:$x4: $%TelegramDv$ 0x7a083:$x5: KeyLoggerEventArgs 0x7a419:$x5: KeyLoggerEventArgs 0x7dadc:$m1: \| Snake Keylogger 0x7db82:$m1: \| Snake Keylogger 0x7dcd6:$m1: \| Snake Keylogger 0x7ddfc:$m1: \| Snake Keylogger 0x7df56:$m1: \| Snake Keylogger 0x7da7c:$m2: Clipboard Logs ID 0x7dc8c:$m2: Screenshot Logs ID 0x7dda0:$m2: keystroke Logs ID 0x7df8c:$m3: SnakePW 0x7dc64:$m4: \SnakeKeylogger\
00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18ce0:$x1: $%SMTPDV$ 0x179a2:$x2: $#TheHashHere%& 0x18c88:$x3: %FTPDV$ 0x17984:$x4: $%TelegramDv$ 0x152b3:$x5: KeyLoggerEventArgs 0x15649:$x5: KeyLoggerEventArgs 0x18d0c:$m1: \| Snake Keylogger 0x18db2:$m1: \| Snake Keylogger 0x18f06:$m1: \| Snake Keylogger 0x1902c:$m1: \| Snake Keylogger 0x19186:$m1: \| Snake Keylogger 0x18cac:$m2: Clipboard Logs ID 0x18ebc:$m2: Screenshot Logs ID 0x18fd0:$m2: keystroke Logs ID 0x191bc:$m3: SnakePW 0x18e94:$m4: \SnakeKeylogger\
00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7dab0:$x1: $%SMTPDV$ 0x7c772:$x2: $#TheHashHere%& 0x7da58:$x3: %FTPDV$ 0x7c754:$x4: $%TelegramDv$ 0x7a083:$x5: KeyLoggerEventArgs 0x7a419:$x5: KeyLoggerEventArgs 0x7dadc:$m1: \| Snake Keylogger 0x7db82:$m1: \| Snake Keylogger 0x7dcd6:$m1: \| Snake Keylogger 0x7ddfc:$m1: \| Snake Keylogger 0x7df56:$m1: \| Snake Keylogger 0x7da7c:$m2: Clipboard Logs ID 0x7dc8c:$m2: Screenshot Logs ID 0x7dda0:$m2: keystroke Logs ID 0x7df8c:$m3: SnakePW 0x7dc64:$m4: \SnakeKeylogger\
00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18ce0:$x1: $%SMTPDV$ 0x179a2:$x2: $#TheHashHere%& 0x18c88:$x3: %FTPDV$ 0x17984:$x4: $%TelegramDv$ 0x152b3:$x5: KeyLoggerEventArgs 0x15649:$x5: KeyLoggerEventArgs 0x18d0c:$m1: \| Snake Keylogger 0x18db2:$m1: \| Snake Keylogger 0x18f06:$m1: \| Snake Keylogger 0x1902c:$m1: \| Snake Keylogger 0x19186:$m1: \| Snake Keylogger 0x18cac:$m2: Clipboard Logs ID 0x18ebc:$m2: Screenshot Logs ID 0x18fd0:$m2: keystroke Logs ID 0x191bc:$m3: SnakePW 0x18e94:$m4: \SnakeKeylogger\
Process Memory Space: RFQ__637456464647.exe PID: 6312	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RFQ__637456464647.exe PID: 6312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ__637456464647.exe PID: 6312	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1aece:$x5: KeyLoggerEventArgs 0x1b264:$x5: KeyLoggerEventArgs 0x1bb9a:$x5: KeyLoggerEventArgs 0x1befb:$x5: KeyLoggerEventArgs 0x61273:$x5: KeyLoggerEventArgs 0x61609:$x5: KeyLoggerEventArgs 0x61f3f:$x5: KeyLoggerEventArgs 0x622a0:$x5: KeyLoggerEventArgs 0x76fbc:$x5: KeyLoggerEventArgs 0x77352:$x5: KeyLoggerEventArgs 0x77c88:$x5: KeyLoggerEventArgs 0x77fe9:$x5: KeyLoggerEventArgs 0x1d3a4:$m1: \| Snake Keylogger 0x1d3f3:$m1: \| Snake Keylogger 0x1d487:$m1: \| Snake Keylogger 0x1d4e8:$m1: \| Snake Keylogger 0x1d55d:$m1: \| Snake Keylogger 0x63749:$m1: \| Snake Keylogger 0x63798:$m1: \| Snake Keylogger 0x6382c:$m1: \| Snake Keylogger 0x6388d:$m1: \| Snake Keylogger
Process Memory Space: RFQ__637456464647.exe PID: 6400	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RFQ__637456464647.exe PID: 6400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ__637456464647.exe PID: 6400	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5f43:$x5: KeyLoggerEventArgs 0x62d9:$x5: KeyLoggerEventArgs 0x6c0f:$x5: KeyLoggerEventArgs 0x6f70:$x5: KeyLoggerEventArgs 0x8419:$m1: \| Snake Keylogger 0x8468:$m1: \| Snake Keylogger 0x84fc:$m1: \| Snake Keylogger 0x855d:$m1: \| Snake Keylogger 0x85d2:$m1: \| Snake Keylogger 0x83e8:$m2: Clipboard Logs ID 0x84d7:$m2: Screenshot Logs ID 0x852f:$m2: keystroke Logs ID 0x85ed:$m3: SnakePW 0x84c3:$m4: \SnakeKeylogger\
Click to see the 57 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.RFQ__637456464647.exe.400000.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b0d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a2b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a700:$a4: \Orbitum\User Data\Default\Login Data 0x1b881:$a5: \Kometa\User Data\Default\Login Data
1.0.RFQ__637456464647.exe.400000.6.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.0.RFQ__637456464647.exe.400000.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.0.RFQ__637456464647.exe.400000.6.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.RFQ__637456464647.exe.400000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.RFQ__637456464647.exe.400000.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
1.0.RFQ__637456464647.exe.400000.6.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.45692e0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x192d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x184b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x18900:$a4: \Orbitum\User Data\Default\Login Data 0x19a81:$a5: \Kometa\User Data\Default\Login Data
0.0.RFQ__637456464647.exe.45692e0.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.45692e0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.45692e0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.45692e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x128eb:$s1: UnHook 0x128f2:$s2: SetHook 0x128fa:$s3: CallNextHook 0x12907:$s4: _hook
0.0.RFQ__637456464647.exe.45692e0.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x169d0:$x1: $%SMTPDV$ 0x15692:$x2: $#TheHashHere%& 0x16978:$x3: %FTPDV$ 0x15674:$x4: $%TelegramDv$ 0x12fa3:$x5: KeyLoggerEventArgs 0x13339:$x5: KeyLoggerEventArgs 0x169fc:$m1: \| Snake Keylogger 0x16aa2:$m1: \| Snake Keylogger 0x16bf6:$m1: \| Snake Keylogger 0x16d1c:$m1: \| Snake Keylogger 0x16e76:$m1: \| Snake Keylogger 0x1699c:$m2: Clipboard Logs ID 0x16bac:$m2: Screenshot Logs ID 0x16cc0:$m2: keystroke Logs ID 0x16eac:$m3: SnakePW 0x16b84:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.42c9510.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x192d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x184b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x18900:$a4: \Orbitum\User Data\Default\Login Data 0x19a81:$a5: \Kometa\User Data\Default\Login Data
0.0.RFQ__637456464647.exe.42c9510.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.42c9510.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.42c9510.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.42c9510.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x128eb:$s1: UnHook 0x128f2:$s2: SetHook 0x128fa:$s3: CallNextHook 0x12907:$s4: _hook
0.0.RFQ__637456464647.exe.42c9510.5.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x169d0:$x1: $%SMTPDV$ 0x15692:$x2: $#TheHashHere%& 0x16978:$x3: %FTPDV$ 0x15674:$x4: $%TelegramDv$ 0x12fa3:$x5: KeyLoggerEventArgs 0x13339:$x5: KeyLoggerEventArgs 0x169fc:$m1: \| Snake Keylogger 0x16aa2:$m1: \| Snake Keylogger 0x16bf6:$m1: \| Snake Keylogger 0x16d1c:$m1: \| Snake Keylogger 0x16e76:$m1: \| Snake Keylogger 0x1699c:$m2: Clipboard Logs ID 0x16bac:$m2: Screenshot Logs ID 0x16cc0:$m2: keystroke Logs ID 0x16eac:$m3: SnakePW 0x16b84:$m4: \SnakeKeylogger\
1.2.RFQ__637456464647.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b0d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a2b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a700:$a4: \Orbitum\User Data\Default\Login Data 0x1b881:$a5: \Kometa\User Data\Default\Login Data
1.2.RFQ__637456464647.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RFQ__637456464647.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RFQ__637456464647.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RFQ__637456464647.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ__637456464647.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
1.2.RFQ__637456464647.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
1.0.RFQ__637456464647.exe.400000.10.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b0d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a2b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a700:$a4: \Orbitum\User Data\Default\Login Data 0x1b881:$a5: \Kometa\User Data\Default\Login Data
1.0.RFQ__637456464647.exe.400000.10.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.0.RFQ__637456464647.exe.400000.10.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.0.RFQ__637456464647.exe.400000.10.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.RFQ__637456464647.exe.400000.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.RFQ__637456464647.exe.400000.10.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
1.0.RFQ__637456464647.exe.400000.10.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.45692e0.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x192d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x184b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x18900:$a4: \Orbitum\User Data\Default\Login Data 0x19a81:$a5: \Kometa\User Data\Default\Login Data
0.0.RFQ__637456464647.exe.45692e0.6.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.45692e0.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.45692e0.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.45692e0.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x128eb:$s1: UnHook 0x128f2:$s2: SetHook 0x128fa:$s3: CallNextHook 0x12907:$s4: _hook
0.0.RFQ__637456464647.exe.45692e0.6.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x169d0:$x1: $%SMTPDV$ 0x15692:$x2: $#TheHashHere%& 0x16978:$x3: %FTPDV$ 0x15674:$x4: $%TelegramDv$ 0x12fa3:$x5: KeyLoggerEventArgs 0x13339:$x5: KeyLoggerEventArgs 0x169fc:$m1: \| Snake Keylogger 0x16aa2:$m1: \| Snake Keylogger 0x16bf6:$m1: \| Snake Keylogger 0x16d1c:$m1: \| Snake Keylogger 0x16e76:$m1: \| Snake Keylogger 0x1699c:$m2: Clipboard Logs ID 0x16bac:$m2: Screenshot Logs ID 0x16cc0:$m2: keystroke Logs ID 0x16eac:$m3: SnakePW 0x16b84:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.42c9510.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x192d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x184b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x18900:$a4: \Orbitum\User Data\Default\Login Data 0x19a81:$a5: \Kometa\User Data\Default\Login Data
0.0.RFQ__637456464647.exe.42c9510.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.42c9510.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.42c9510.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.42c9510.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x128eb:$s1: UnHook 0x128f2:$s2: SetHook 0x128fa:$s3: CallNextHook 0x12907:$s4: _hook
0.0.RFQ__637456464647.exe.42c9510.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x169d0:$x1: $%SMTPDV$ 0x15692:$x2: $#TheHashHere%& 0x16978:$x3: %FTPDV$ 0x15674:$x4: $%TelegramDv$ 0x12fa3:$x5: KeyLoggerEventArgs 0x13339:$x5: KeyLoggerEventArgs 0x169fc:$m1: \| Snake Keylogger 0x16aa2:$m1: \| Snake Keylogger 0x16bf6:$m1: \| Snake Keylogger 0x16d1c:$m1: \| Snake Keylogger 0x16e76:$m1: \| Snake Keylogger 0x1699c:$m2: Clipboard Logs ID 0x16bac:$m2: Screenshot Logs ID 0x16cc0:$m2: keystroke Logs ID 0x16eac:$m3: SnakePW 0x16b84:$m4: \SnakeKeylogger\
1.0.RFQ__637456464647.exe.400000.12.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b0d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a2b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a700:$a4: \Orbitum\User Data\Default\Login Data 0x1b881:$a5: \Kometa\User Data\Default\Login Data
1.0.RFQ__637456464647.exe.400000.12.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.0.RFQ__637456464647.exe.400000.12.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.0.RFQ__637456464647.exe.400000.12.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.RFQ__637456464647.exe.400000.12.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.RFQ__637456464647.exe.400000.12.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
1.0.RFQ__637456464647.exe.400000.12.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.2.RFQ__637456464647.exe.45692e0.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x192d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x184b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x18900:$a4: \Orbitum\User Data\Default\Login Data 0x19a81:$a5: \Kometa\User Data\Default\Login Data
0.2.RFQ__637456464647.exe.45692e0.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ__637456464647.exe.45692e0.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ__637456464647.exe.45692e0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ__637456464647.exe.45692e0.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x128eb:$s1: UnHook 0x128f2:$s2: SetHook 0x128fa:$s3: CallNextHook 0x12907:$s4: _hook
0.2.RFQ__637456464647.exe.45692e0.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x169d0:$x1: $%SMTPDV$ 0x15692:$x2: $#TheHashHere%& 0x16978:$x3: %FTPDV$ 0x15674:$x4: $%TelegramDv$ 0x12fa3:$x5: KeyLoggerEventArgs 0x13339:$x5: KeyLoggerEventArgs 0x169fc:$m1: \| Snake Keylogger 0x16aa2:$m1: \| Snake Keylogger 0x16bf6:$m1: \| Snake Keylogger 0x16d1c:$m1: \| Snake Keylogger 0x16e76:$m1: \| Snake Keylogger 0x1699c:$m2: Clipboard Logs ID 0x16bac:$m2: Screenshot Logs ID 0x16cc0:$m2: keystroke Logs ID 0x16eac:$m3: SnakePW 0x16b84:$m4: \SnakeKeylogger\
1.0.RFQ__637456464647.exe.400000.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b0d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a2b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a700:$a4: \Orbitum\User Data\Default\Login Data 0x1b881:$a5: \Kometa\User Data\Default\Login Data
1.0.RFQ__637456464647.exe.400000.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.0.RFQ__637456464647.exe.400000.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.0.RFQ__637456464647.exe.400000.4.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.RFQ__637456464647.exe.400000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.RFQ__637456464647.exe.400000.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
1.0.RFQ__637456464647.exe.400000.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.2.RFQ__637456464647.exe.42c9510.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x192d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x184b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x18900:$a4: \Orbitum\User Data\Default\Login Data 0x19a81:$a5: \Kometa\User Data\Default\Login Data
0.2.RFQ__637456464647.exe.42c9510.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ__637456464647.exe.42c9510.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ__637456464647.exe.42c9510.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ__637456464647.exe.42c9510.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x128eb:$s1: UnHook 0x128f2:$s2: SetHook 0x128fa:$s3: CallNextHook 0x12907:$s4: _hook
0.2.RFQ__637456464647.exe.42c9510.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x169d0:$x1: $%SMTPDV$ 0x15692:$x2: $#TheHashHere%& 0x16978:$x3: %FTPDV$ 0x15674:$x4: $%TelegramDv$ 0x12fa3:$x5: KeyLoggerEventArgs 0x13339:$x5: KeyLoggerEventArgs 0x169fc:$m1: \| Snake Keylogger 0x16aa2:$m1: \| Snake Keylogger 0x16bf6:$m1: \| Snake Keylogger 0x16d1c:$m1: \| Snake Keylogger 0x16e76:$m1: \| Snake Keylogger 0x1699c:$m2: Clipboard Logs ID 0x16bac:$m2: Screenshot Logs ID 0x16cc0:$m2: keystroke Logs ID 0x16eac:$m3: SnakePW 0x16b84:$m4: \SnakeKeylogger\
1.0.RFQ__637456464647.exe.400000.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1b0d0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1a2b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1a700:$a4: \Orbitum\User Data\Default\Login Data 0x1b881:$a5: \Kometa\User Data\Default\Login Data
1.0.RFQ__637456464647.exe.400000.8.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.0.RFQ__637456464647.exe.400000.8.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.0.RFQ__637456464647.exe.400000.8.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.RFQ__637456464647.exe.400000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.RFQ__637456464647.exe.400000.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
1.0.RFQ__637456464647.exe.400000.8.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x146eb:$s1: UnHook 0x146f2:$s2: SetHook 0x146fa:$s3: CallNextHook 0x14707:$s4: _hook
0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x187d0:$x1: $%SMTPDV$ 0x17492:$x2: $#TheHashHere%& 0x18778:$x3: %FTPDV$ 0x17474:$x4: $%TelegramDv$ 0x14da3:$x5: KeyLoggerEventArgs 0x15139:$x5: KeyLoggerEventArgs 0x187fc:$m1: \| Snake Keylogger 0x188a2:$m1: \| Snake Keylogger 0x189f6:$m1: \| Snake Keylogger 0x18b1c:$m1: \| Snake Keylogger 0x18c76:$m1: \| Snake Keylogger 0x1879c:$m2: Clipboard Logs ID 0x189ac:$m2: Screenshot Logs ID 0x18ac0:$m2: keystroke Logs ID 0x18cac:$m3: SnakePW 0x18984:$m4: \SnakeKeylogger\
Click to see the 109 entries

Snort Signatures

ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check - Source IP: 192.168.2.3 - Destination IP: 132.226.8.169

Timestamp:	192.168.2.3132.226.8.16949740802842536 05/23/22-19:00:12.710166
SID:	2842536
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram Token": "Null!", "Telegram ID": "5164987354:AAFbwY5baNRyoCilWU25jL6nSQnU8yn8vuc"}

Multi AV Scanner detection for submitted file

Source: RFQ__637456464647.exe

ReversingLabs: Detection: 46%

Machine Learning detection for sample

Source: RFQ__637456464647.exe

Joe Sandbox ML: detected

Source: 1.0.RFQ__637456464647.exe.400000.12.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.2.RFQ__637456464647.exe.400000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.0.RFQ__637456464647.exe.400000.8.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.0.RFQ__637456464647.exe.400000.6.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.0.RFQ__637456464647.exe.400000.4.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.0.RFQ__637456464647.exe.400000.10.unpack	Avira: Label: TR/ATRAPS.Gen

Source: RFQ__637456464647.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: RFQ__637456464647.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: System.Windows.Forms.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDSD source: WER7284.tmp.dmp.13.dr
Source:	Binary string: k,C:\Windows\System.pdb source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.Windows.Forms.pdbxT source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdbRSDS source: WER7284.tmp.dmp.13.dr
Source:	Binary string: 7.PDB source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\RFQ__637456464647.PDB source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: .pdb, source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.pdbP>Q source: WER7284.tmp.dmp.13.dr
Source:	Binary string: C:\Users\user\Desktop\RFQ__637456464647.PDB6 source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: chrome.exe.pdb source: RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr
Source:	Binary string: System.Core.ni.pdb source: WER7284.tmp.dmp.13.dr

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 054D0741h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 054D02E9h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 054D0B99h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 0648E0A9h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 064848D1h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06485181h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 0648E981h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06488149h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 064889F9h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06485A31h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 0648F231h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06483771h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06486739h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06486FE9h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06484021h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06487899h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06487CF1h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 064885A1h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06484D29h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 0648E529h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 064855D9h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 0648EDD9h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06485E89h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 0648F689h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06483319h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 064862E1h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 0648FAE1h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06486B91h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06483BC9h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06484479h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then jmp 06487441h
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2842536 ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check 192.168.2.3:49740 -> 132.226.8.169:80

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

ASN Name: UTMEMUS UTMEMUS

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RFQ__637456464647.exe, 00000001.00000002.529500482.0000000002FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RFQ__637456464647.exe, 00000001.00000002.528823599.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000001.00000002.529500482.0000000002FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RFQ__637456464647.exe, 00000001.00000002.528823599.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RFQ__637456464647.exe, 00000001.00000002.528823599.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org4Jk
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: chrome.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: RFQ__637456464647.exe	String found in binary or memory: http://sawebservice.red-gate.com/
Source: RFQ__637456464647.exe, 00000001.00000002.528823599.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RFQ__637456464647.exe	String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/
Source: RFQ__637456464647.exe	String found in binary or memory: http://www.smartassembly.com/webservices/Reporting/UploadReport2
Source: RFQ__637456464647.exe	String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/
Source: RFQ__637456464647.exe	String found in binary or memory: http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr	String found in binary or memory: https://crashpad.chromium.org/
Source: RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: RFQ__637456464647.exe	String found in binary or memory: https://dsssdsa.fa
Source: RFQ__637456464647.exe	String found in binary or memory: https://dsssdsa.fa)Uri

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: RFQ__637456464647.exe, 00000000.00000002.316474597.000000000174A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RFQ__637456464647.exe PID: 6312, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RFQ__637456464647.exe PID: 6400, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: RFQ__637456464647.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RFQ__637456464647.exe PID: 6312, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RFQ__637456464647.exe PID: 6400, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 1296

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D0498
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D0040
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D4318
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D2398
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D4FB0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D4968
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D29E0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D08F0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D3678
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D16F8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D3028
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D1D48
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D3CC8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D0493
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D0016
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D430A
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D2388
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D4F9F
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D4959
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D29CF
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D08E0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D3668
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D16EA
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D3018
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D1D38
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_054D3CB9
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648DE00
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06484628
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06484ED8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648E6D8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06487EA0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06488750
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648B770
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06485788
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648EF88
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064834C8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06486490
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06486D40
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06483D78
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064875F0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06487A48
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064882F8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06484A80
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648E280
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06485330
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648EB30
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06485BE0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648F3E0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648C398
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06488BA8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06480040
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06483070
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06486038
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648F838
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064868E8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648D098
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06483920
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064841D0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06487198
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06484621
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06484EC8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648E6C8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648B6C9
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06487E90
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06488741
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06485778
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648EF79
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06486483
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064834B8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06483D68
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06486D37
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064875E0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648DDF0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06484A70
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648E271
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06487A3B
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064882E8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648EB20
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06485321
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06485BD0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648F3D0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06483063
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648C00F
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648F828
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648602F
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_0648C020
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06480033
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064868D8
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06483910
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_064841C0
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Code function: 1_2_06487188
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B761E0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B76A10
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B67160
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B5B170
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B13980
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B3B220
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8AADA80
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B993DC
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8A76BA0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8A74B50
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B5DB20
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8BE1CE0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8AAE4B0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B3DC90
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8A76C80
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B395A0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B665D0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8AA4540
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8AB0540
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8A75D90
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8C05550
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8A77D60
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8AB96A0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8C0CEC0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B5A630
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B5AFE0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B65FA0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8AE9780
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B3E8B0
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8AC60E0

Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: String function: 00007FF7A8A9AED0 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: String function: 00007FF7A8BBD690 appears 39 times

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Code function: 0_2_01722F68 CreateProcessAsUserA,

Source: RFQ__637456464647.exe	Binary or memory string: OriginalFilename vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000000.00000000.292339706.00000000032C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000000.00000002.316474597.000000000174A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000000.00000000.298522029.000000000174A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe	Binary or memory string: OriginalFilename vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000001.00000000.267745770.0000000000422000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYFGGCVyufgtwfyuTGFWTVFAUYVF.exeX vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe, 00000001.00000002.527555148.0000000000F37000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs RFQ__637456464647.exe
Source: RFQ__637456464647.exe	Binary or memory string: OriginalFilenameJxIIaRUTvaLxexPWTLbbe.exe4 vs RFQ__637456464647.exe

Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: chrome.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: chrome.exe.0.dr

Static PE information: Number of sections : 11 > 10

Source: RFQ__637456464647.exe

ReversingLabs: Detection: 46%

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

File read: C:\Users\user\Desktop\RFQ__637456464647.exe

Jump to behavior

Source: RFQ__637456464647.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\RFQ__637456464647.exe "C:\Users\user\Desktop\RFQ__637456464647.exe"
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process created: C:\Users\user\Desktop\RFQ__637456464647.exe C:\Users\user\Desktop\RFQ__637456464647.exe
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process created: C:\Users\user\AppData\Local\Temp\chrome.exe "C:\Users\user\AppData\Local\Temp\chrome.exe"
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 1296
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process created: C:\Users\user\Desktop\RFQ__637456464647.exe C:\Users\user\Desktop\RFQ__637456464647.exe
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process created: C:\Users\user\AppData\Local\Temp\chrome.exe "C:\Users\user\AppData\Local\Temp\chrome.exe"

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

File created: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: chrome.exe.0.dr	Binary string: HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_PERFORMANCE_DATAHKEY_PERFORMANCE_TEXTHKEY_PERFORMANCE_NLSTEXTHKEY_CURRENT_CONFIGHKEY_DYN_DATA\Device\\Device\HarddiskVolumeverifier.dllKeyg_handles_to_closesbox_alternate_desktop_local_winstation_0x%X
Source: chrome.exe.0.dr	Binary string: CreateAppContainerProfileuserenvDeriveAppContainerSidFromAppContainerNameGetAppContainerRegistryLocationGetAppContainerFolderPath\\.\pipe\%ls\%ls@g_interceptionsntdll.dllg_originalsg_ntntdll.dllNtSetInformationThreadNtOpenThreadTokenNtOpenThreadTokenExkernel32.dll\Device\

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@2/2

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: 0.0.RFQ__637456464647.exe.d20000.4.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.RFQ__637456464647.exe.8f0000.13.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.RFQ__637456464647.exe.8f0000.0.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.2.RFQ__637456464647.exe.d20000.0.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.RFQ__637456464647.exe.8f0000.11.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.RFQ__637456464647.exe.8f0000.1.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.RFQ__637456464647.exe.d20000.0.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: RFQ__637456464647.exe, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.RFQ__637456464647.exe.d20000.1.unpack, u000fu0005/u0095u0005.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()

Source: C:\Users\user\AppData\Local\Temp\chrome.exe

Code function: 5_2_00007FF7A8BDA170 FormatMessageA,GetLastError,

Source: RFQ__637456464647.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6312

Source: chrome.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: chrome.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: chrome.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: chrome.exe	String found in binary or memory: Try '%ls --help' for more information.

Source: RFQ__637456464647.exe, u0097/u0005u0002.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RFQ__637456464647.exe, u0097/u0005u0002.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: RFQ__637456464647.exe, u001a/u0094u0008.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.RFQ__637456464647.exe.d20000.1.unpack, u0097/u0005u0002.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.RFQ__637456464647.exe.d20000.1.unpack, u0097/u0005u0002.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.RFQ__637456464647.exe.d20000.1.unpack, u001a/u0094u0008.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.RFQ__637456464647.exe.d20000.4.unpack, u0097/u0005u0002.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.RFQ__637456464647.exe.d20000.4.unpack, u0097/u0005u0002.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.RFQ__637456464647.exe.d20000.4.unpack, u001a/u0094u0008.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: RFQ__637456464647.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: RFQ__637456464647.exe

Static file information: File size 2844160 > 1048576

Source: RFQ__637456464647.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ__637456464647.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2b5a00

Source: RFQ__637456464647.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: System.Windows.Forms.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDSD source: WER7284.tmp.dmp.13.dr
Source:	Binary string: k,C:\Windows\System.pdb source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.Windows.Forms.pdbxT source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdbRSDS source: WER7284.tmp.dmp.13.dr
Source:	Binary string: 7.PDB source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\RFQ__637456464647.PDB source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: .pdb, source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.pdbP>Q source: WER7284.tmp.dmp.13.dr
Source:	Binary string: C:\Users\user\Desktop\RFQ__637456464647.PDB6 source: RFQ__637456464647.exe, 00000000.00000000.297785720.0000000001367000.00000004.00000010.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.316242132.0000000001367000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WER7284.tmp.dmp.13.dr
Source:	Binary string: chrome.exe.pdb source: RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr
Source:	Binary string: System.Core.ni.pdb source: WER7284.tmp.dmp.13.dr

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Code function: 1_2_054D9B97 push B000005Eh; iretd

Source: chrome.exe.0.dr	Static PE information: section name: .00cfg
Source: chrome.exe.0.dr	Static PE information: section name: .retplne
Source: chrome.exe.0.dr	Static PE information: section name: CPADinfo
Source: chrome.exe.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

File created: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to dropped file

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\chrome.exe

Code function: 5_2_00007FF7A8B391C0 GetSystemTimeAsFileTime followed by cmp: cmp rdi, 13h and CTI: jc 00007FF7A8B39523h

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\chrome.exe

Code function: 5_2_00007FF7A8AA4330 GetCurrentThread,IsDebuggerPresent,GetModuleHandleW,GetProcAddress,_Init_thread_footer,GetCurrentThreadId,RaiseException,

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Code function: 1_2_06482D81 LdrInitializeThunk,

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B13980 SetUnhandledExceptionFilter,K32GetPerformanceInfo,K32GetProcessMemoryInfo,GetProcessHandleCount,
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8A77D60 SetUnhandledExceptionFilter,SetConsoleCtrlHandler,_Init_thread_footer,SetProcessShutdownParameters,GetLastError,
Source: C:\Users\user\AppData\Local\Temp\chrome.exe	Code function: 5_2_00007FF7A8B9AFA0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: RFQ__637456464647.exe, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 0.0.RFQ__637456464647.exe.d20000.1.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 0.0.RFQ__637456464647.exe.d20000.4.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 0.0.RFQ__637456464647.exe.d20000.0.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 0.2.RFQ__637456464647.exe.d20000.0.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 1.0.RFQ__637456464647.exe.8f0000.0.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 1.0.RFQ__637456464647.exe.8f0000.11.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, ufffdW?ufffd?/u061d????.cs	Reference to suspicious API methods: ('???Z?', 'MapVirtualKey@user32.dll')
Source: 1.0.RFQ__637456464647.exe.400000.12.unpack, ?u0040???/ufffd?ufffd??.cs	Reference to suspicious API methods: ('?????', 'LoadLibrary@kernel32.dll'), ('?????', 'GetProcAddress@kernel32')
Source: 1.0.RFQ__637456464647.exe.8f0000.13.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')
Source: 1.0.RFQ__637456464647.exe.8f0000.1.unpack, u000fu0005/u000eu0005.cs	Reference to suspicious API methods: ('?\\x04', 'GetProcAddress@kernel32')

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Memory written: C:\Users\user\Desktop\RFQ__637456464647.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process created: C:\Users\user\Desktop\RFQ__637456464647.exe C:\Users\user\Desktop\RFQ__637456464647.exe
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Process created: C:\Users\user\AppData\Local\Temp\chrome.exe "C:\Users\user\AppData\Local\Temp\chrome.exe"

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Users\user\Desktop\RFQ__637456464647.exe VolumeInformation
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Users\user\Desktop\RFQ__637456464647.exe VolumeInformation
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\chrome.exe

Code function: 5_2_00007FF7A8AC60E0 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,_Init_thread_footer,CreateNamedPipeW,SetLastError,GetLastError,GetLastError,

Source: C:\Users\user\AppData\Local\Temp\chrome.exe

Code function: 5_2_00007FF7A8B8819C GetSystemTimeAsFileTime,

Source: C:\Users\user\AppData\Local\Temp\chrome.exe

Code function: 5_2_00007FF7A8A8B550 GetVersionExW,GetProductInfo,_Init_thread_footer,GetNativeSystemInfo,_Init_thread_footer,

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ__637456464647.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ__637456464647.exe PID: 6400, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\RFQ__637456464647.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\Desktop\RFQ__637456464647.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\RFQ__637456464647.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ__637456464647.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ__637456464647.exe PID: 6400, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ__637456464647.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RFQ__637456464647.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.42c9510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ__637456464647.exe.45692e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.42c9510.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.RFQ__637456464647.exe.45692e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ__637456464647.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ__637456464647.exe PID: 6400, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	2 OS Credential Dumping	11 System Time Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Access Token Manipulation	1 Input Capture	2 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	112 Process Injection	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Disable or Modify Tools	NTDS	1 Process Discovery	Distributed Component Object Model	2 Data from Local System	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	112 Process Injection	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ__637456464647.exe	46%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
RFQ__637456464647.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\chrome.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\chrome.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.0.RFQ__637456464647.exe.400000.12.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.2.RFQ__637456464647.exe.400000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.0.RFQ__637456464647.exe.400000.8.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.0.RFQ__637456464647.exe.400000.6.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.0.RFQ__637456464647.exe.400000.4.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.0.RFQ__637456464647.exe.400000.10.unpack	100%	Avira	TR/ATRAPS.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://dsssdsa.fa)Uri	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.smartassembly.com/webservices/Reporting/UploadReport2	0%	URL Reputation	safe
https://dsssdsa.fa	0%	Avira URL Cloud	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://www.smartassembly.com/webservices/Reporting/	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://www.smartassembly.com/webservices/UploadReportLogin/	0%	URL Reputation	safe
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	0%	URL Reputation	safe
http://checkip.dyndns.org4Jk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
checkip.dyndns.com	132.226.8.169	true	true		unknown
checkip.dyndns.org	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dsssdsa.fa)Uri	RFQ__637456464647.exe	false	Avira URL Cloud: safe	low
https://crashpad.chromium.org/	RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr	false		high
https://api.telegram.org/bot	RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/bug/new	RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr	false		high
http://checkip.dyndns.org/q	RFQ__637456464647.exe, 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sawebservice.red-gate.com/	RFQ__637456464647.exe	false		high
http://www.smartassembly.com/webservices/Reporting/UploadReport2	RFQ__637456464647.exe	false	URL Reputation: safe	unknown
https://dsssdsa.fa	RFQ__637456464647.exe	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	RFQ__637456464647.exe, 00000001.00000002.528823599.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000001.00000002.529500482.0000000002FF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.smartassembly.com/webservices/Reporting/	RFQ__637456464647.exe	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	RFQ__637456464647.exe, 00000001.00000002.529500482.0000000002FF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ__637456464647.exe, 00000001.00000002.528823599.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	RFQ__637456464647.exe, 00000000.00000002.317423148.00000000044C2000.00000004.00000800.00020000.00000000.sdmp, RFQ__637456464647.exe, 00000000.00000002.318083841.0000000004762000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000000.281746338.00007FF7A8C4A000.00000002.00000001.01000000.00000006.sdmp, chrome.exe.0.dr	false		high
http://www.smartassembly.com/webservices/UploadReportLogin/	RFQ__637456464647.exe	false	URL Reputation: safe	unknown
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL	RFQ__637456464647.exe	false	URL Reputation: safe	unknown
http://checkip.dyndns.org4Jk	RFQ__637456464647.exe, 00000001.00000002.528823599.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States		16989	UTMEMUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632544
Start date and time: 23/05/202218:58:49	2022-05-23 18:58:49 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 22s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	RFQ__637456464647.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@2/2
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 16.1% (good quality ratio 13%) Quality average: 58.1% Quality standard deviation: 37.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, onedsblobprdcus15.centralus.cloudapp.azure.com, store-images.s-microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, arc.msn.com
Execution Graph export aborted for target chrome.exe, PID 6672 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:00:24	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RFQ__63745646464_94dd9d68755d61cc97c9e42d0ec1b28c5989ec6_083b13b0_1b958159\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0802804484479727
Encrypted:	false
SSDEEP:	192:WOyEvUsxHBUZMXSaKtXfW/u7s4S274Itw:ZyEvUSBUZMXSah/u7s4X4Itw
MD5:	E56BC667B3B678430631F7CE3B8BBD4C
SHA1:	EA08F52BDD81A1D5BD03C34A20802621A13A5E8C
SHA-256:	3C7F3BEF460243B93180F3CCBD3CBC10971A29097D21F53C4B57598568A8058C
SHA-512:	F0ED9A2F476CD8B0899F8234DF82D1FFE2480992EC4EAE7A3957214828AFE6A64B9DCF86399061B7889A108F69F41485A778C450FBDC86D64B8B15D2E69B33D4
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.7.8.3.1.2.2.0.5.7.1.0.4.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.7.8.3.1.2.2.2.9.1.4.7.8.7.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.5.a.a.d.a.1.6.-.4.1.d.c.-.4.9.d.f.-.a.e.5.1.-.3.4.8.f.7.9.c.5.3.0.7.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.5.2.5.6.8.f.-.b.b.9.9.-.4.8.f.2.-.b.a.9.1.-.9.a.0.e.c.b.9.8.4.a.0.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.F.Q._._.6.3.7.4.5.6.4.6.4.6.4.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.J.x.I.I.a.R.U.T.v.a.L.x.e.x.P.W.T.L.b.b.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.a.8.-.0.0.0.1.-.0.0.1.d.-.9.b.e.e.-.a.2.f.7.1.1.6.f.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.b.d.2.8.a.4.2.a.c.e.9.6.7.0.f.5.3.9.7.b.7.b.0.8.5.f.4.b.9.c.f.0.0.0.0.0.0.0.0.!.0.0.0.0.5.9.2.a.8.1.4.a.4.2.8.c.8.a.5.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7284.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue May 24 02:00:21 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	265529
Entropy (8bit):	3.312337303087705
Encrypted:	false
SSDEEP:	3072:rkHORSy0dv9UCgUnOw9gIOgF5xlH0DhmGndsTjd+pe:rkkTcTjP9RpDxt0AGFp
MD5:	7973C58C32915FBA6B5E4EEE9BF12854
SHA1:	8FBE6CBECD95C5CE84DC87F9A6399D06FD2BDBBC
SHA-256:	0583DBAE1CBBF287351119BDE87703268E64DA8D430F9D3C33A9D99C185432B2
SHA-512:	16E6182D38A8D0AB550B3FA310E6FC81E84E8AEEF686015B9050A2F8CB1A74D6C406CEFBC0A830E496F8655DEADB904F7444CA7835083ECBF4B1235098380EE9
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......5<.b............t.......................T...p"...........T..........`.......8...........T............A..)............"...........$...................................................................U...........B......H%......GenuineIntelW...........T............<.b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78ED.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.6962392631754497
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNicG6yVG6YWhSUvlCvGgmfZF3S3Cprz89bphsfSYjm:RrlsNi16yVG6YgSUvlzgmf73S7pafSx
MD5:	DB6D045DBC6C75AE674930E621C24D0C
SHA1:	EC5D9E89F492C938C6B45FD7948D6D7E630575C0
SHA-256:	6763D58AA2DA5B1C0DB34B2CD54ABF3DEA1334933A99F235945CFDD3CD6B445A
SHA-512:	27D6CDA8DA201F33BCEFFBD510B010C421FD95B0D2871636315AA63C3147B43E11CB310388FB9AD143452D723651EFF61E9350C20A72AD7EB47BF5352048A18A
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.1.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A56.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4794
Entropy (8bit):	4.506229802328503
Encrypted:	false
SSDEEP:	48:cvIwSD8zsjJgtWI9AGWgc8sqYj68fm8M4JKOwO7FnHno+q8vrOwOsUPOY4TsK3QE:uITf9nHgrsqYbJ7wcIKawyPO1Y1ud
MD5:	10BD2D57F1961B27D477C05A55D89E59
SHA1:	1ABFAD5821C4BC61962184488F33565531BB59F9
SHA-256:	40DBD1A60D73AA328FAB8171384B79764B1A0F1A934FB1038CC0BE506F2CEB11
SHA-512:	D8A24722E437F15B220AF4A2AC6BB5DA80E8F6B90C25CA69C3FCE203329D755953F8F9B739039FC3EE766DFB9D7273A9790535D741CBB8856F02A386D36C828F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1528511" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\RFQ__637456464647.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2622352
Entropy (8bit):	6.584925607886023
Encrypted:	false
SSDEEP:	49152:ZkwWDBRk5Swp1oFSFb8XUK+3crWECSP/cESM0RCZ/Sf8peUTbVkyC:2TX79FXCaSMHpC
MD5:	7F916511A313837EFCDE9E4112A64E5B
SHA1:	6A2A2427CF1D888CB40A18527478C84DEDF1DB61
SHA-256:	F342AF2B1E3DD9BA90C10F643EC1F50459EFBB5912496E8AC553682C2B7A9F6E
SHA-512:	A2F92AE37D6ECD16D7B4312EA2548F494D01BD386A439E05258073F4038FCFA60BD7D79FCB8CA5B285BAC121799826B87655EC594F7B4A9CCF5DA70CE3273E1B
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....\|b.........."...........................@..............................(.......(...`..........................................u ......u .P.....#.P.....".......'..#....(..#...L .8...................XK .(....!..0............} .....`f .`....................text...x........................... ..`.rdata...#... ...$..................@..@.data....+...P!......,!.............@....pdata........".......!.............@..@.00cfg..(....`#.......".............@..@.retplne$....p#......."..................tls....9.....#.......".............@...CPADinfo8.....#.......".............@..._RDATA........#.......".............@..@.rsrc...P.....#.......".............@..@.reloc...#....(..$....'.............@..B................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.991836040381107
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	RFQ__637456464647.exe
File size:	2844160
MD5:	b4bc907e8d48e8f09b4d9fdd8d416599
SHA1:	592a814a428c8a5de3f06245996fc775e8dc987f
SHA256:	7f7804a5460695dae61e378d733f0a613083e84c654ea6264a5276944b33f943
SHA512:	b74608846f9e494789e52b79e1aab9fd5fa7918b46441cc0cf2ee0d2883151c327180b4119bbeae6bd83360dcedc8c6142e6fab0b56650b818aa51a2527d6759
SSDEEP:	49152:oXJTCTSfReUawVjvGdhAD7E3IJ6daAQeFdjwCE1/02Xro9+83qpK:suoRZawVjvGdhGE3IJA/jwD82013q
TLSH:	A9D52383B38AA47AF0BC25B4DCC3EB834F65579C5665FCD62A8151AC38253BBE570213
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.................Z+..........y+.. ....+...@.. ........................+.......+...@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x6b791a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x628B062E [Mon May 23 03:57:34 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b78d0	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b8000	0x72a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2ba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2b5920	0x2b5a00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x2b8000	0x72a	0x800	False	0.31591796875	data	4.48924436504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2ba000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2b80b8	0x27c	data
RT_MANIFEST	0x2b8334	0x1fa	XML 1.0 document, ASCII text, with very long lines, with no line terminators
RT_MANIFEST	0x2b8530	0x1fa	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	JxIIaRUTvaLxexPWTLbbe.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	JxIIaRUTvaLxexPWTLbbe.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3132.226.8.16949740802842536 05/23/22-19:00:12.710166	TCP	2842536	ETPRO TROJAN 404/Snake/Matiex Keylogger Style External IP Check	49740	80	192.168.2.3	132.226.8.169

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 19:00:09.422519922 CEST	49740	80	192.168.2.3	132.226.8.169
May 23, 2022 19:00:12.433237076 CEST	49740	80	192.168.2.3	132.226.8.169
May 23, 2022 19:00:12.709538937 CEST	80	49740	132.226.8.169	192.168.2.3
May 23, 2022 19:00:12.709647894 CEST	49740	80	192.168.2.3	132.226.8.169
May 23, 2022 19:00:12.710165977 CEST	49740	80	192.168.2.3	132.226.8.169
May 23, 2022 19:00:12.986522913 CEST	80	49740	132.226.8.169	192.168.2.3
May 23, 2022 19:00:13.988107920 CEST	80	49740	132.226.8.169	192.168.2.3
May 23, 2022 19:00:14.126456022 CEST	49740	80	192.168.2.3	132.226.8.169
May 23, 2022 19:01:18.987670898 CEST	80	49740	132.226.8.169	192.168.2.3
May 23, 2022 19:01:18.987759113 CEST	49740	80	192.168.2.3	132.226.8.169
May 23, 2022 19:01:54.057121992 CEST	49740	80	192.168.2.3	132.226.8.169
May 23, 2022 19:01:54.333545923 CEST	80	49740	132.226.8.169	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 19:00:09.279763937 CEST	64851	53	192.168.2.3	8.8.8.8
May 23, 2022 19:00:09.298605919 CEST	53	64851	8.8.8.8	192.168.2.3
May 23, 2022 19:00:09.312563896 CEST	49316	53	192.168.2.3	8.8.8.8
May 23, 2022 19:00:09.331444979 CEST	53	49316	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 19:00:09.279763937 CEST	192.168.2.3	8.8.8.8	0xc5ee	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.312563896 CEST	192.168.2.3	8.8.8.8	0x2cce	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 23, 2022 19:00:09.298605919 CEST	8.8.8.8	192.168.2.3	0xc5ee	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
May 23, 2022 19:00:09.298605919 CEST	8.8.8.8	192.168.2.3	0xc5ee	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.298605919 CEST	8.8.8.8	192.168.2.3	0xc5ee	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.298605919 CEST	8.8.8.8	192.168.2.3	0xc5ee	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.298605919 CEST	8.8.8.8	192.168.2.3	0xc5ee	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.298605919 CEST	8.8.8.8	192.168.2.3	0xc5ee	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.331444979 CEST	8.8.8.8	192.168.2.3	0x2cce	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
May 23, 2022 19:00:09.331444979 CEST	8.8.8.8	192.168.2.3	0x2cce	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.331444979 CEST	8.8.8.8	192.168.2.3	0x2cce	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.331444979 CEST	8.8.8.8	192.168.2.3	0x2cce	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.331444979 CEST	8.8.8.8	192.168.2.3	0x2cce	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
May 23, 2022 19:00:09.331444979 CEST	8.8.8.8	192.168.2.3	0x2cce	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49740	132.226.8.169	80	C:\Users\user\Desktop\RFQ__637456464647.exe

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 19:00:12.710165977 CEST	1139	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 23, 2022 19:00:13.988107920 CEST	1139	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 17:00:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 31 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.19</body></html>

Target ID:	0
Start time:	18:59:56
Start date:	23/05/2022
Path:	C:\Users\user\Desktop\RFQ__637456464647.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ__637456464647.exe"
Imagebase:	0xd20000
File size:	2844160 bytes
MD5 hash:	B4BC907E8D48E8F09B4D9FDD8D416599
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.295208630.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.300985988.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.318129181.00000000047A4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.293530185.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.292477124.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.300121250.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.317016109.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.317478170.0000000004504000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.299489390.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Analysis Process: RFQ__637456464647.exePID: 6400, Parent PID: 6312

General

Target ID:	1
Start time:	18:59:58
Start date:	23/05/2022
Path:	C:\Users\user\Desktop\RFQ__637456464647.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\RFQ__637456464647.exe
Imagebase:	0x8f0000
File size:	2844160 bytes
MD5 hash:	B4BC907E8D48E8F09B4D9FDD8D416599
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000000.267692324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000000.266228380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000002.525677202.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000000.270358708.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000000.268966946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Analysis Process: chrome.exePID: 6672, Parent PID: 6312

General

Target ID:	5
Start time:	19:00:08
Start date:	23/05/2022
Path:	C:\Users\user\AppData\Local\Temp\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\chrome.exe"
Imagebase:	0x7ff7a8a70000
File size:	2622352 bytes
MD5 hash:	7F916511A313837EFCDE9E4112A64E5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	low

Analysis Process: WerFault.exePID: 7124, Parent PID: 6312

General

Target ID:	13
Start time:	19:00:19
Start date:	23/05/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 1296
Imagebase:	0xf40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ__637456464647.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RFQ__63745646464_94dd9d68755d61cc97c9e42d0ec1b28c5989ec6_083b13b0_1b958159\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7284.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78ED.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A56.tmp.xml

C:\Users\user\AppData\Local\Temp\chrome.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
RFQ__637456464647.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre