Windows Analysis Report
O1ySvN9SvL

Overview

General Information

Sample Name: O1ySvN9SvL (renamed file extension from none to exe)
Analysis ID: 635319
MD5: caa4c5d863a9324fa6b3a735ed446897
SHA1: 003348501064dc5646b19019592f8aefa4b44f5b
SHA256: 6796f10e7f6140f26a49bf9446b2c75dfe0e6dc7d7d88cad5e09d9b608107851
Tags: 32exeFormbooktrojan
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Sample uses process hollowing technique
Uses netstat to query active network connections and open ports
Maps a DLL or memory area into another process
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.knoxvillehojo.com/a5vu/"], "decoy": ["larrysormonddaytona.com", "stagify.net", "polyesterwadding.com", "smartcontractauditing.xyz", "pier88lasvegas.com", "albertapainters.com", "mujid24s.com", "tidyaghast.com", "viatempo.com", "gzqgc.com", "pragmatic168.pro", "gapeminimalistic.online", "bloomingbeauties247.com", "thaiperty.com", "thebrocab.com", "dinkycars.net", "alphamaio.com", "skoolksa.com", "kongresprawnikow.info", "cryptoinvestment.gold", "datcapark.com", "ashleystawart.com", "allure-selectshop.com", "uranolite.xyz", "zjgw88.com", "jimsvarietyshop.com", "visual-industry.com", "inboxburn.xyz", "rrew.tools", "denizdenobjeler.com", "infoshope.com", "50mim6.com", "zdcx123.com", "668400.com", "authopro.xyz", "techwebsite.tech", "bluelioninvestments.com", "loncheraspanama.com", "legalnurseresearch.net", "leonwarrencapital.com", "456837.com", "killercatsss.com", "alpha-farmers.info", "myoilomega.com", "lavid.life", "toxicwaterclaims.com", "xiaoqimz.xyz", "nights.life", "digsbury.ventures", "apclimo.com", "tinasglorybutter.com", "savingshk.com", "chanongrouptowercrane.com", "ugcuk.com", "saint-leo.com", "jiujiecanyin.com", "santamariaweddings.com", "mandap.xyz", "saigonloving.com", "huntingblindbrackets.com", "myjurorapp.com", "multiconnectico.com", "xn--oy2ay6s.xn--55qx5d", "businessvlogging.com"]}
Multi AV Scanner detection for submitted file
Source: O1ySvN9SvL.exe Virustotal: Detection: 49% Perma Link
Source: O1ySvN9SvL.exe ReversingLabs: Detection: 53%
Yara detected FormBook
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.knoxvillehojo.com/a5vu/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe ReversingLabs: Detection: 50%
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.zrztlh.exe.730000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.zrztlh.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.zrztlh.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.zrztlh.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.zrztlh.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Uses 32bit PE files
Source: O1ySvN9SvL.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: netstat.pdbGCTL source: zrztlh.exe, 00000002.00000002.533807993.00000000030C0000.00000040.10000000.00040000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532341402.0000000000D99000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bbzbv\zvllpn\ulml\6c213aee395f4218a983d22c1476bfe1\cpuiyl\nereonvn\Release\nereonvn.pdb source: O1ySvN9SvL.exe, 00000000.00000002.476064921.000000000040B000.00000004.00000001.01000000.00000003.sdmp, O1ySvN9SvL.exe, 00000000.00000002.476520590.0000000002857000.00000004.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000001.00000000.435751978.0000000000EC7000.00000002.00000001.01000000.00000004.sdmp, zrztlh.exe, 00000001.00000002.448197888.0000000000EC7000.00000002.00000001.01000000.00000004.sdmp, zrztlh.exe, 00000002.00000000.441820881.0000000000EC7000.00000002.00000001.01000000.00000004.sdmp, NETSTAT.EXE, 0000000A.00000002.719075583.000000000385F000.00000004.10000000.00040000.00000000.sdmp, zrztlh.exe.0.dr, nsr4D4E.tmp.0.dr
Source: Binary string: netstat.pdb source: zrztlh.exe, 00000002.00000002.533807993.00000000030C0000.00000040.10000000.00040000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532341402.0000000000D99000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: zrztlh.exe, 00000001.00000003.439382237.0000000002430000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000001.00000003.440475430.000000001D330000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000003.449985411.000000000108A000.00000004.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532918261.000000000133F000.00000040.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532513113.0000000001220000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000002.716785893.0000000003330000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.533826728.0000000003199000.00000004.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000002.718064275.000000000344F000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.532287288.0000000000E78000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: zrztlh.exe, 00000001.00000003.439382237.0000000002430000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000001.00000003.440475430.000000001D330000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000003.449985411.000000000108A000.00000004.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532918261.000000000133F000.00000040.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532513113.0000000001220000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 0000000A.00000002.716785893.0000000003330000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.533826728.0000000003199000.00000004.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000002.718064275.000000000344F000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.532287288.0000000000E78000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00405426 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405426
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00405D9C SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405D9C
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_004026A1 FindFirstFileA, 0_2_004026A1
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 4x nop then pop edi 2_2_0040E454
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 4x nop then pop edi 2_2_0040E481
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 4x nop then pop edi 2_2_00417D7E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop edi 10_2_007CE454
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop edi 10_2_007CE481
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop edi 10_2_007D7D7E

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.savingshk.com
Source: C:\Windows\explorer.exe Network Connect: 188.114.97.3 80 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49798 -> 188.114.97.3:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49798 -> 188.114.97.3:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49798 -> 188.114.97.3:80
Uses netstat to query active network connections and open ports
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.knoxvillehojo.com/a5vu/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /a5vu/?l2MHK=FVYX5&4hOD6=FXMAgLN/IrBd2h0A7KmJ0dUV04fd60Tmz3QO5NzukmZcmTlm3Sf9IrYXmxrDB/U5IQUf HTTP/1.1Host: www.savingshk.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: NETSTAT.EXE, 0000000A.00000002.719201108.0000000003D4F000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.savingshk.com/a5vu/?l2MHK=FVYX5&4hOD6=FXMAgLN/IrBd2h0A7KmJ0dUV04fd60Tmz3QO5NzukmZcmTlm3S
Source: unknown DNS traffic detected: queries for: www.savingshk.com
Source: global traffic HTTP traffic detected: GET /a5vu/?l2MHK=FVYX5&4hOD6=FXMAgLN/IrBd2h0A7KmJ0dUV04fd60Tmz3QO5NzukmZcmTlm3Sf9IrYXmxrDB/U5IQUf HTTP/1.1Host: www.savingshk.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Creates a DirectInput object (often for capturing keystrokes)
Source: O1ySvN9SvL.exe, 00000000.00000002.476364274.000000000072A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00404FDD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404FDD

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: O1ySvN9SvL.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_004032FA EntryPoint,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004032FA
Detected potential crypto function
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_004047EE 0_2_004047EE
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00406083 0_2_00406083
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EC1A6F 1_2_00EC1A6F
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EC0276 1_2_00EC0276
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EC4CC4 1_2_00EC4CC4
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EBAC14 1_2_00EBAC14
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EC2D97 1_2_00EC2D97
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EC0D53 1_2_00EC0D53
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EC3659 1_2_00EC3659
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EC07E1 1_2_00EC07E1
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB5FCE 1_2_00EB5FCE
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041D85E 2_2_0041D85E
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041E1B1 2_2_0041E1B1
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041EC25 2_2_0041EC25
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00402D87 2_2_00402D87
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00409E5D 2_2_00409E5D
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00409E60 2_2_00409E60
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00409E1A 2_2_00409E1A
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EC1A6F 2_2_00EC1A6F
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EC0276 2_2_00EC0276
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EC4CC4 2_2_00EC4CC4
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EBAC14 2_2_00EBAC14
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EC2D97 2_2_00EC2D97
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EC0D53 2_2_00EC0D53
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EC3659 2_2_00EC3659
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EC07E1 2_2_00EC07E1
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EB5FCE 2_2_00EB5FCE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03422B28 10_2_03422B28
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338EBB0 10_2_0338EBB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0341DBD2 10_2_0341DBD2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03421FF1 10_2_03421FF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03376E30 10_2_03376E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03422EF7 10_2_03422EF7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_034222AE 10_2_034222AE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03350D20 10_2_03350D20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03421D55 10_2_03421D55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03374120 10_2_03374120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335F900 10_2_0335F900
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03422D07 10_2_03422D07
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382581 10_2_03382581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336D5E0 10_2_0336D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336841F 10_2_0336841F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411002 10_2_03411002
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033820A0 10_2_033820A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336B090 10_2_0336B090
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_034220A8 10_2_034220A8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DD85E 10_2_007DD85E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DEC25 10_2_007DEC25
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007C2D90 10_2_007C2D90
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007C2D87 10_2_007C2D87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007C9E60 10_2_007C9E60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007C9E5D 10_2_007C9E5D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007C9E1A 10_2_007C9E1A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007C2FB0 10_2_007C2FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 0335B150 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: String function: 00EAF1E0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: String function: 00EB2233 appears 43 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041A330 NtCreateFile, 2_2_0041A330
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041A3E0 NtReadFile, 2_2_0041A3E0
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041A460 NtClose, 2_2_0041A460
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041A510 NtAllocateVirtualMemory, 2_2_0041A510
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041A32A NtCreateFile, 2_2_0041A32A
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041A3DB NtReadFile, 2_2_0041A3DB
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041A45A NtClose, 2_2_0041A45A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399710 NtQueryInformationToken,LdrInitializeThunk, 10_2_03399710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399780 NtMapViewOfSection,LdrInitializeThunk, 10_2_03399780
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399FE0 NtCreateMutant,LdrInitializeThunk, 10_2_03399FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_03399660
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399A50 NtCreateFile,LdrInitializeThunk, 10_2_03399A50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399650 NtQueryValueKey,LdrInitializeThunk, 10_2_03399650
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033996E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_033996E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033996D0 NtCreateKey,LdrInitializeThunk, 10_2_033996D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_03399910
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399540 NtReadFile,LdrInitializeThunk, 10_2_03399540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033999A0 NtCreateSection,LdrInitializeThunk, 10_2_033999A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033995D0 NtClose,LdrInitializeThunk, 10_2_033995D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_03399860
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399840 NtDelayExecution,LdrInitializeThunk, 10_2_03399840
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399730 NtQueryVirtualMemory, 10_2_03399730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0339A710 NtOpenProcessToken, 10_2_0339A710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399B00 NtSetValueKey, 10_2_03399B00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399770 NtSetInformationFile, 10_2_03399770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0339A770 NtOpenThread, 10_2_0339A770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399760 NtOpenProcess, 10_2_03399760
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0339A3B0 NtGetContextThread, 10_2_0339A3B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033997A0 NtUnmapViewOfSection, 10_2_033997A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399A20 NtResumeThread, 10_2_03399A20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399610 NtEnumerateValueKey, 10_2_03399610
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399A10 NtQuerySection, 10_2_03399A10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399A00 NtProtectVirtualMemory, 10_2_03399A00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399670 NtQueryInformationProcess, 10_2_03399670
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399A80 NtOpenDirectoryObject, 10_2_03399A80
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0339AD30 NtSetContextThread, 10_2_0339AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399520 NtWaitForSingleObject, 10_2_03399520
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399560 NtWriteFile, 10_2_03399560
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399950 NtQueueApcThread, 10_2_03399950
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033995F0 NtQueryInformationFile, 10_2_033995F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033999D0 NtCreateProcessEx, 10_2_033999D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03399820 NtEnumerateKey, 10_2_03399820
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0339B040 NtSuspendThread, 10_2_0339B040
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033998A0 NtWriteVirtualMemory, 10_2_033998A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033998F0 NtReadVirtualMemory, 10_2_033998F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DA330 NtCreateFile, 10_2_007DA330
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DA3E0 NtReadFile, 10_2_007DA3E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DA460 NtClose, 10_2_007DA460
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DA510 NtAllocateVirtualMemory, 10_2_007DA510
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DA32A NtCreateFile, 10_2_007DA32A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DA3DB NtReadFile, 10_2_007DA3DB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DA45A NtClose, 10_2_007DA45A
Source: O1ySvN9SvL.exe Virustotal: Detection: 49%
Source: O1ySvN9SvL.exe ReversingLabs: Detection: 53%
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe File read: C:\Users\user\Desktop\O1ySvN9SvL.exe Jump to behavior
Source: O1ySvN9SvL.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\O1ySvN9SvL.exe "C:\Users\user\Desktop\O1ySvN9SvL.exe"
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Process created: C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\kplemx
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Process created: C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\kplemx
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\zrztlh.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Process created: C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\kplemx Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Process created: C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\kplemx Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\zrztlh.exe" Jump to behavior
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe File created: C:\Users\user\AppData\Local\Temp\nsr4D4D.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@9/4@2/1
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00402078 CoCreateInstance,MultiByteToWideChar, 0_2_00402078
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00404333 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_00404333
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5704:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Binary string: netstat.pdbGCTL source: zrztlh.exe, 00000002.00000002.533807993.00000000030C0000.00000040.10000000.00040000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532341402.0000000000D99000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\bbzbv\zvllpn\ulml\6c213aee395f4218a983d22c1476bfe1\cpuiyl\nereonvn\Release\nereonvn.pdb source: O1ySvN9SvL.exe, 00000000.00000002.476064921.000000000040B000.00000004.00000001.01000000.00000003.sdmp, O1ySvN9SvL.exe, 00000000.00000002.476520590.0000000002857000.00000004.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000001.00000000.435751978.0000000000EC7000.00000002.00000001.01000000.00000004.sdmp, zrztlh.exe, 00000001.00000002.448197888.0000000000EC7000.00000002.00000001.01000000.00000004.sdmp, zrztlh.exe, 00000002.00000000.441820881.0000000000EC7000.00000002.00000001.01000000.00000004.sdmp, NETSTAT.EXE, 0000000A.00000002.719075583.000000000385F000.00000004.10000000.00040000.00000000.sdmp, zrztlh.exe.0.dr, nsr4D4E.tmp.0.dr
Source: Binary string: netstat.pdb source: zrztlh.exe, 00000002.00000002.533807993.00000000030C0000.00000040.10000000.00040000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532341402.0000000000D99000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: zrztlh.exe, 00000001.00000003.439382237.0000000002430000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000001.00000003.440475430.000000001D330000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000003.449985411.000000000108A000.00000004.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532918261.000000000133F000.00000040.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532513113.0000000001220000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000002.716785893.0000000003330000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.533826728.0000000003199000.00000004.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000002.718064275.000000000344F000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.532287288.0000000000E78000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: zrztlh.exe, 00000001.00000003.439382237.0000000002430000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000001.00000003.440475430.000000001D330000.00000004.00001000.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000003.449985411.000000000108A000.00000004.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532918261.000000000133F000.00000040.00000800.00020000.00000000.sdmp, zrztlh.exe, 00000002.00000002.532513113.0000000001220000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 0000000A.00000002.716785893.0000000003330000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.533826728.0000000003199000.00000004.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000002.718064275.000000000344F000.00000040.00000800.00020000.00000000.sdmp, NETSTAT.EXE, 0000000A.00000003.532287288.0000000000E78000.00000004.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EAF225 push ecx; ret 1_2_00EAF238
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0040E309 push ds; ret 2_2_0040E313
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0040E452 push ebp; ret 2_2_0040E453
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041C403 pushad ; iretd 2_2_0041C40D
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041D4D2 push eax; ret 2_2_0041D4D8
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041D4DB push eax; ret 2_2_0041D542
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041D485 push eax; ret 2_2_0041D4D8
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00416567 push 4E87C1F6h; iretd 2_2_00416572
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00417D75 push ebx; iretd 2_2_00417D78
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041D53C push eax; ret 2_2_0041D542
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0041668F push ecx; iretd 2_2_0041669F
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0040AFA3 push cs; retf 2_2_0040AFA8
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EAF225 push ecx; ret 2_2_00EAF238
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033AD0D1 push ecx; ret 10_2_033AD0E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007CE309 push ds; ret 10_2_007CE313
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007CE452 push ebp; ret 10_2_007CE453
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DC403 pushad ; iretd 10_2_007DC40D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DD4DB push eax; ret 10_2_007DD542
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DD4D2 push eax; ret 10_2_007DD4D8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DD485 push eax; ret 10_2_007DD4D8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007D7D75 push ebx; iretd 10_2_007D7D78
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007D6567 push 4E87C1F6h; iretd 10_2_007D6572
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007DD53C push eax; ret 10_2_007DD542
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007D668F push ecx; iretd 10_2_007D669F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_007CAFA3 push cs; retf 10_2_007CAFA8
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00405DDA GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405DDA
Drops PE files
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe File created: C:\Users\user\AppData\Local\Temp\zrztlh.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8A 0xAE 0xEE
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 00000000007C9904 second address: 00000000007C990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 00000000007C9B7E second address: 00000000007C9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6876 Thread sleep time: -36000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 7104 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\NETSTAT.EXE Last function: Thread delayed
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00409AB0 rdtsc 2_2_00409AB0
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe API coverage: 9.5 %
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe API coverage: 3.4 %
Source: C:\Windows\SysWOW64\NETSTAT.EXE API coverage: 9.8 %
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00405426 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405426
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00405D9C SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405D9C
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_004026A1 FindFirstFileA, 0_2_004026A1
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000003.00000000.475786546.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.476567949.000000000807B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}8Ll/
Source: explorer.exe, 00000003.00000000.476567949.000000000807B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.476567949.000000000807B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000000.512235091.0000000006915000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.476567949.000000000807B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000003.00000000.497195090.0000000007F92000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB57E5 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 1_2_00EB57E5
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB57E5 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 1_2_00EB57E5
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\O1ySvN9SvL.exe Code function: 0_2_00405DDA GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405DDA
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB6AAA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 1_2_00EB6AAA
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00409AB0 rdtsc 2_2_00409AB0
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338E730 mov eax, dword ptr fs:[00000030h] 10_2_0338E730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03428B58 mov eax, dword ptr fs:[00000030h] 10_2_03428B58
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03354F2E mov eax, dword ptr fs:[00000030h] 10_2_03354F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03354F2E mov eax, dword ptr fs:[00000030h] 10_2_03354F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337F716 mov eax, dword ptr fs:[00000030h] 10_2_0337F716
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03428F6A mov eax, dword ptr fs:[00000030h] 10_2_03428F6A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EFF10 mov eax, dword ptr fs:[00000030h] 10_2_033EFF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EFF10 mov eax, dword ptr fs:[00000030h] 10_2_033EFF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338A70E mov eax, dword ptr fs:[00000030h] 10_2_0338A70E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338A70E mov eax, dword ptr fs:[00000030h] 10_2_0338A70E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03383B7A mov eax, dword ptr fs:[00000030h] 10_2_03383B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03383B7A mov eax, dword ptr fs:[00000030h] 10_2_03383B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0342070D mov eax, dword ptr fs:[00000030h] 10_2_0342070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0342070D mov eax, dword ptr fs:[00000030h] 10_2_0342070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335DB60 mov ecx, dword ptr fs:[00000030h] 10_2_0335DB60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336FF60 mov eax, dword ptr fs:[00000030h] 10_2_0336FF60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0341131B mov eax, dword ptr fs:[00000030h] 10_2_0341131B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335F358 mov eax, dword ptr fs:[00000030h] 10_2_0335F358
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335DB40 mov eax, dword ptr fs:[00000030h] 10_2_0335DB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336EF40 mov eax, dword ptr fs:[00000030h] 10_2_0336EF40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03384BAD mov eax, dword ptr fs:[00000030h] 10_2_03384BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03384BAD mov eax, dword ptr fs:[00000030h] 10_2_03384BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03384BAD mov eax, dword ptr fs:[00000030h] 10_2_03384BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03368794 mov eax, dword ptr fs:[00000030h] 10_2_03368794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338B390 mov eax, dword ptr fs:[00000030h] 10_2_0338B390
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D7794 mov eax, dword ptr fs:[00000030h] 10_2_033D7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D7794 mov eax, dword ptr fs:[00000030h] 10_2_033D7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D7794 mov eax, dword ptr fs:[00000030h] 10_2_033D7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382397 mov eax, dword ptr fs:[00000030h] 10_2_03382397
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03361B8F mov eax, dword ptr fs:[00000030h] 10_2_03361B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03361B8F mov eax, dword ptr fs:[00000030h] 10_2_03361B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0340D380 mov ecx, dword ptr fs:[00000030h] 10_2_0340D380
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0341138A mov eax, dword ptr fs:[00000030h] 10_2_0341138A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033937F5 mov eax, dword ptr fs:[00000030h] 10_2_033937F5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033803E2 mov eax, dword ptr fs:[00000030h] 10_2_033803E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033803E2 mov eax, dword ptr fs:[00000030h] 10_2_033803E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033803E2 mov eax, dword ptr fs:[00000030h] 10_2_033803E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033803E2 mov eax, dword ptr fs:[00000030h] 10_2_033803E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033803E2 mov eax, dword ptr fs:[00000030h] 10_2_033803E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033803E2 mov eax, dword ptr fs:[00000030h] 10_2_033803E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337DBE9 mov eax, dword ptr fs:[00000030h] 10_2_0337DBE9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03425BA5 mov eax, dword ptr fs:[00000030h] 10_2_03425BA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D53CA mov eax, dword ptr fs:[00000030h] 10_2_033D53CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D53CA mov eax, dword ptr fs:[00000030h] 10_2_033D53CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335E620 mov eax, dword ptr fs:[00000030h] 10_2_0335E620
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03394A2C mov eax, dword ptr fs:[00000030h] 10_2_03394A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03394A2C mov eax, dword ptr fs:[00000030h] 10_2_03394A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0340B260 mov eax, dword ptr fs:[00000030h] 10_2_0340B260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0340B260 mov eax, dword ptr fs:[00000030h] 10_2_0340B260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03428A62 mov eax, dword ptr fs:[00000030h] 10_2_03428A62
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335AA16 mov eax, dword ptr fs:[00000030h] 10_2_0335AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335AA16 mov eax, dword ptr fs:[00000030h] 10_2_0335AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338A61C mov eax, dword ptr fs:[00000030h] 10_2_0338A61C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338A61C mov eax, dword ptr fs:[00000030h] 10_2_0338A61C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03355210 mov eax, dword ptr fs:[00000030h] 10_2_03355210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03355210 mov ecx, dword ptr fs:[00000030h] 10_2_03355210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03355210 mov eax, dword ptr fs:[00000030h] 10_2_03355210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03355210 mov eax, dword ptr fs:[00000030h] 10_2_03355210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03373A1C mov eax, dword ptr fs:[00000030h] 10_2_03373A1C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335C600 mov eax, dword ptr fs:[00000030h] 10_2_0335C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335C600 mov eax, dword ptr fs:[00000030h] 10_2_0335C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335C600 mov eax, dword ptr fs:[00000030h] 10_2_0335C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03388E00 mov eax, dword ptr fs:[00000030h] 10_2_03388E00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03368A0A mov eax, dword ptr fs:[00000030h] 10_2_03368A0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0339927A mov eax, dword ptr fs:[00000030h] 10_2_0339927A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337AE73 mov eax, dword ptr fs:[00000030h] 10_2_0337AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337AE73 mov eax, dword ptr fs:[00000030h] 10_2_0337AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337AE73 mov eax, dword ptr fs:[00000030h] 10_2_0337AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337AE73 mov eax, dword ptr fs:[00000030h] 10_2_0337AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337AE73 mov eax, dword ptr fs:[00000030h] 10_2_0337AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411608 mov eax, dword ptr fs:[00000030h] 10_2_03411608
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336766D mov eax, dword ptr fs:[00000030h] 10_2_0336766D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033E4257 mov eax, dword ptr fs:[00000030h] 10_2_033E4257
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359240 mov eax, dword ptr fs:[00000030h] 10_2_03359240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359240 mov eax, dword ptr fs:[00000030h] 10_2_03359240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359240 mov eax, dword ptr fs:[00000030h] 10_2_03359240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359240 mov eax, dword ptr fs:[00000030h] 10_2_03359240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03367E41 mov eax, dword ptr fs:[00000030h] 10_2_03367E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03367E41 mov eax, dword ptr fs:[00000030h] 10_2_03367E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03367E41 mov eax, dword ptr fs:[00000030h] 10_2_03367E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03367E41 mov eax, dword ptr fs:[00000030h] 10_2_03367E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03367E41 mov eax, dword ptr fs:[00000030h] 10_2_03367E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03367E41 mov eax, dword ptr fs:[00000030h] 10_2_03367E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0340FE3F mov eax, dword ptr fs:[00000030h] 10_2_0340FE3F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0340FEC0 mov eax, dword ptr fs:[00000030h] 10_2_0340FEC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336AAB0 mov eax, dword ptr fs:[00000030h] 10_2_0336AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336AAB0 mov eax, dword ptr fs:[00000030h] 10_2_0336AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338FAB0 mov eax, dword ptr fs:[00000030h] 10_2_0338FAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033552A5 mov eax, dword ptr fs:[00000030h] 10_2_033552A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033552A5 mov eax, dword ptr fs:[00000030h] 10_2_033552A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033552A5 mov eax, dword ptr fs:[00000030h] 10_2_033552A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033552A5 mov eax, dword ptr fs:[00000030h] 10_2_033552A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033552A5 mov eax, dword ptr fs:[00000030h] 10_2_033552A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03428ED6 mov eax, dword ptr fs:[00000030h] 10_2_03428ED6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D46A7 mov eax, dword ptr fs:[00000030h] 10_2_033D46A7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338D294 mov eax, dword ptr fs:[00000030h] 10_2_0338D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338D294 mov eax, dword ptr fs:[00000030h] 10_2_0338D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EFE87 mov eax, dword ptr fs:[00000030h] 10_2_033EFE87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033676E2 mov eax, dword ptr fs:[00000030h] 10_2_033676E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033816E0 mov ecx, dword ptr fs:[00000030h] 10_2_033816E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382AE4 mov eax, dword ptr fs:[00000030h] 10_2_03382AE4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03420EA5 mov eax, dword ptr fs:[00000030h] 10_2_03420EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03420EA5 mov eax, dword ptr fs:[00000030h] 10_2_03420EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03420EA5 mov eax, dword ptr fs:[00000030h] 10_2_03420EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382ACB mov eax, dword ptr fs:[00000030h] 10_2_03382ACB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033836CC mov eax, dword ptr fs:[00000030h] 10_2_033836CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03398EC7 mov eax, dword ptr fs:[00000030h] 10_2_03398EC7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338513A mov eax, dword ptr fs:[00000030h] 10_2_0338513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338513A mov eax, dword ptr fs:[00000030h] 10_2_0338513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03363D34 mov eax, dword ptr fs:[00000030h] 10_2_03363D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03384D3B mov eax, dword ptr fs:[00000030h] 10_2_03384D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03384D3B mov eax, dword ptr fs:[00000030h] 10_2_03384D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03384D3B mov eax, dword ptr fs:[00000030h] 10_2_03384D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335AD30 mov eax, dword ptr fs:[00000030h] 10_2_0335AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033DA537 mov eax, dword ptr fs:[00000030h] 10_2_033DA537
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03374120 mov eax, dword ptr fs:[00000030h] 10_2_03374120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03374120 mov eax, dword ptr fs:[00000030h] 10_2_03374120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03374120 mov eax, dword ptr fs:[00000030h] 10_2_03374120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03374120 mov eax, dword ptr fs:[00000030h] 10_2_03374120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03374120 mov ecx, dword ptr fs:[00000030h] 10_2_03374120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359100 mov eax, dword ptr fs:[00000030h] 10_2_03359100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359100 mov eax, dword ptr fs:[00000030h] 10_2_03359100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359100 mov eax, dword ptr fs:[00000030h] 10_2_03359100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337C577 mov eax, dword ptr fs:[00000030h] 10_2_0337C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337C577 mov eax, dword ptr fs:[00000030h] 10_2_0337C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335B171 mov eax, dword ptr fs:[00000030h] 10_2_0335B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335B171 mov eax, dword ptr fs:[00000030h] 10_2_0335B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335C962 mov eax, dword ptr fs:[00000030h] 10_2_0335C962
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03377D50 mov eax, dword ptr fs:[00000030h] 10_2_03377D50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337B944 mov eax, dword ptr fs:[00000030h] 10_2_0337B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337B944 mov eax, dword ptr fs:[00000030h] 10_2_0337B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03428D34 mov eax, dword ptr fs:[00000030h] 10_2_03428D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03393D43 mov eax, dword ptr fs:[00000030h] 10_2_03393D43
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D3540 mov eax, dword ptr fs:[00000030h] 10_2_033D3540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D51BE mov eax, dword ptr fs:[00000030h] 10_2_033D51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D51BE mov eax, dword ptr fs:[00000030h] 10_2_033D51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D51BE mov eax, dword ptr fs:[00000030h] 10_2_033D51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D51BE mov eax, dword ptr fs:[00000030h] 10_2_033D51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03381DB5 mov eax, dword ptr fs:[00000030h] 10_2_03381DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03381DB5 mov eax, dword ptr fs:[00000030h] 10_2_03381DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03381DB5 mov eax, dword ptr fs:[00000030h] 10_2_03381DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033861A0 mov eax, dword ptr fs:[00000030h] 10_2_033861A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033861A0 mov eax, dword ptr fs:[00000030h] 10_2_033861A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033835A1 mov eax, dword ptr fs:[00000030h] 10_2_033835A1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D69A6 mov eax, dword ptr fs:[00000030h] 10_2_033D69A6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338FD9B mov eax, dword ptr fs:[00000030h] 10_2_0338FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338FD9B mov eax, dword ptr fs:[00000030h] 10_2_0338FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0341FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0341FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0341FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0341FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0341FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0341FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0341FDE2 mov eax, dword ptr fs:[00000030h] 10_2_0341FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382990 mov eax, dword ptr fs:[00000030h] 10_2_03382990
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03408DF1 mov eax, dword ptr fs:[00000030h] 10_2_03408DF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337C182 mov eax, dword ptr fs:[00000030h] 10_2_0337C182
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382581 mov eax, dword ptr fs:[00000030h] 10_2_03382581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382581 mov eax, dword ptr fs:[00000030h] 10_2_03382581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382581 mov eax, dword ptr fs:[00000030h] 10_2_03382581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03382581 mov eax, dword ptr fs:[00000030h] 10_2_03382581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338A185 mov eax, dword ptr fs:[00000030h] 10_2_0338A185
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03352D8A mov eax, dword ptr fs:[00000030h] 10_2_03352D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03352D8A mov eax, dword ptr fs:[00000030h] 10_2_03352D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03352D8A mov eax, dword ptr fs:[00000030h] 10_2_03352D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03352D8A mov eax, dword ptr fs:[00000030h] 10_2_03352D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03352D8A mov eax, dword ptr fs:[00000030h] 10_2_03352D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0335B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0335B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0335B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0335B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033E41E8 mov eax, dword ptr fs:[00000030h] 10_2_033E41E8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336D5E0 mov eax, dword ptr fs:[00000030h] 10_2_0336D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336D5E0 mov eax, dword ptr fs:[00000030h] 10_2_0336D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_034205AC mov eax, dword ptr fs:[00000030h] 10_2_034205AC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_034205AC mov eax, dword ptr fs:[00000030h] 10_2_034205AC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6DC9 mov eax, dword ptr fs:[00000030h] 10_2_033D6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6DC9 mov eax, dword ptr fs:[00000030h] 10_2_033D6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6DC9 mov eax, dword ptr fs:[00000030h] 10_2_033D6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6DC9 mov ecx, dword ptr fs:[00000030h] 10_2_033D6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6DC9 mov eax, dword ptr fs:[00000030h] 10_2_033D6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6DC9 mov eax, dword ptr fs:[00000030h] 10_2_033D6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338BC2C mov eax, dword ptr fs:[00000030h] 10_2_0338BC2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338002D mov eax, dword ptr fs:[00000030h] 10_2_0338002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338002D mov eax, dword ptr fs:[00000030h] 10_2_0338002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338002D mov eax, dword ptr fs:[00000030h] 10_2_0338002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338002D mov eax, dword ptr fs:[00000030h] 10_2_0338002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338002D mov eax, dword ptr fs:[00000030h] 10_2_0338002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336B02A mov eax, dword ptr fs:[00000030h] 10_2_0336B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336B02A mov eax, dword ptr fs:[00000030h] 10_2_0336B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336B02A mov eax, dword ptr fs:[00000030h] 10_2_0336B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336B02A mov eax, dword ptr fs:[00000030h] 10_2_0336B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D7016 mov eax, dword ptr fs:[00000030h] 10_2_033D7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D7016 mov eax, dword ptr fs:[00000030h] 10_2_033D7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D7016 mov eax, dword ptr fs:[00000030h] 10_2_033D7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03412073 mov eax, dword ptr fs:[00000030h] 10_2_03412073
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03421074 mov eax, dword ptr fs:[00000030h] 10_2_03421074
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6C0A mov eax, dword ptr fs:[00000030h] 10_2_033D6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6C0A mov eax, dword ptr fs:[00000030h] 10_2_033D6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6C0A mov eax, dword ptr fs:[00000030h] 10_2_033D6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6C0A mov eax, dword ptr fs:[00000030h] 10_2_033D6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03411C06 mov eax, dword ptr fs:[00000030h] 10_2_03411C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0342740D mov eax, dword ptr fs:[00000030h] 10_2_0342740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0342740D mov eax, dword ptr fs:[00000030h] 10_2_0342740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0342740D mov eax, dword ptr fs:[00000030h] 10_2_0342740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03424015 mov eax, dword ptr fs:[00000030h] 10_2_03424015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03424015 mov eax, dword ptr fs:[00000030h] 10_2_03424015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0337746D mov eax, dword ptr fs:[00000030h] 10_2_0337746D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03370050 mov eax, dword ptr fs:[00000030h] 10_2_03370050
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03370050 mov eax, dword ptr fs:[00000030h] 10_2_03370050
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EC450 mov eax, dword ptr fs:[00000030h] 10_2_033EC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EC450 mov eax, dword ptr fs:[00000030h] 10_2_033EC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338A44B mov eax, dword ptr fs:[00000030h] 10_2_0338A44B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338F0BF mov ecx, dword ptr fs:[00000030h] 10_2_0338F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338F0BF mov eax, dword ptr fs:[00000030h] 10_2_0338F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0338F0BF mov eax, dword ptr fs:[00000030h] 10_2_0338F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03428CD6 mov eax, dword ptr fs:[00000030h] 10_2_03428CD6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033990AF mov eax, dword ptr fs:[00000030h] 10_2_033990AF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033820A0 mov eax, dword ptr fs:[00000030h] 10_2_033820A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033820A0 mov eax, dword ptr fs:[00000030h] 10_2_033820A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033820A0 mov eax, dword ptr fs:[00000030h] 10_2_033820A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033820A0 mov eax, dword ptr fs:[00000030h] 10_2_033820A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033820A0 mov eax, dword ptr fs:[00000030h] 10_2_033820A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033820A0 mov eax, dword ptr fs:[00000030h] 10_2_033820A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_0336849B mov eax, dword ptr fs:[00000030h] 10_2_0336849B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_03359080 mov eax, dword ptr fs:[00000030h] 10_2_03359080
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D3884 mov eax, dword ptr fs:[00000030h] 10_2_033D3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D3884 mov eax, dword ptr fs:[00000030h] 10_2_033D3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_034114FB mov eax, dword ptr fs:[00000030h] 10_2_034114FB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6CF0 mov eax, dword ptr fs:[00000030h] 10_2_033D6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6CF0 mov eax, dword ptr fs:[00000030h] 10_2_033D6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033D6CF0 mov eax, dword ptr fs:[00000030h] 10_2_033D6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033558EC mov eax, dword ptr fs:[00000030h] 10_2_033558EC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EB8D0 mov eax, dword ptr fs:[00000030h] 10_2_033EB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EB8D0 mov ecx, dword ptr fs:[00000030h] 10_2_033EB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EB8D0 mov eax, dword ptr fs:[00000030h] 10_2_033EB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EB8D0 mov eax, dword ptr fs:[00000030h] 10_2_033EB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EB8D0 mov eax, dword ptr fs:[00000030h] 10_2_033EB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 10_2_033EB8D0 mov eax, dword ptr fs:[00000030h] 10_2_033EB8D0
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_0040ACF0 LdrLoadDll, 2_2_0040ACF0
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB1D88 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00EB1D88
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB1D57 SetUnhandledExceptionFilter, 1_2_00EB1D57
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EB1D88 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00EB1D88
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 2_2_00EB1D57 SetUnhandledExceptionFilter, 2_2_00EB1D57

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.savingshk.com
Source: C:\Windows\explorer.exe Network Connect: 188.114.97.3 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: 1180000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Thread register set: target process: 684 Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Thread register set: target process: 684 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Process created: C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\zrztlh.exe C:\Users\user\AppData\Local\Temp\kplemx Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\zrztlh.exe" Jump to behavior
Source: explorer.exe, 00000003.00000000.516249956.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.512096551.0000000006100000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.497020918.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.506026358.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.486135507.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.565839731.0000000001430000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.486135507.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.565839731.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.453908478.0000000001430000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: YProgram Managerf
Source: explorer.exe, 00000003.00000000.486135507.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.565839731.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.453908478.0000000001430000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 1_2_00EBE8C3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 1_2_00EB8FA3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, 1_2_00EBE1D4
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW,_GetPrimaryLen, 1_2_00EBE970
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free, 1_2_00EB8969
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW,_GetPrimaryLen, 1_2_00EBE970
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 1_2_00EA4194
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s, 1_2_00EBEA44
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 1_2_00EBE4A4
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson, 1_2_00EB4CB1
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: EnumSystemLocalesW, 1_2_00EBE448
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free, 1_2_00EA26FB
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage, 1_2_00EBE5A4
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 1_2_00EB9D92
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free,_free,_free, 1_2_00EB8529
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 1_2_00EBE521
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 1_2_00EB8FA3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free,_free,_free, 1_2_00EB8529
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free, 1_2_00EA67B8
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW, 1_2_00EB9FDB
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 1_2_00EB8FA3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, 1_2_00EBE799
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free, 1_2_00EBA75F
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 2_2_00EBE8C3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 2_2_00EB8FA3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: __malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free, 2_2_00EA1110
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, 2_2_00EBE1D4
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW,_GetPrimaryLen, 2_2_00EBE970
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free, 2_2_00EB8969
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW,_GetPrimaryLen, 2_2_00EBE970
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 2_2_00EA4194
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s, 2_2_00EBEA44
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 2_2_00EBE4A4
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson, 2_2_00EB4CB1
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: EnumSystemLocalesW, 2_2_00EBE448
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free, 2_2_00EA26FB
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 2_2_00EB9D92
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free,_free,_free, 2_2_00EB8529
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 2_2_00EBE521
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 2_2_00EB8FA3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free,_free,_free, 2_2_00EB8529
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,_free,_free,_free, 2_2_00EA67B8
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: GetLocaleInfoW, 2_2_00EB9FDB
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 2_2_00EB8FA3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, 2_2_00EBE799
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB00A3 cpuid 1_2_00EB00A3
Source: C:\Users\user\AppData\Local\Temp\zrztlh.exe Code function: 1_2_00EB161F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 1_2_00EB161F

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.zrztlh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.zrztlh.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zrztlh.exe.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.716381096.0000000000E70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532479062.00000000011E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.447718606.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.533348401.0000000001550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.509506176.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.489068141.0000000005327000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.532198194.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.445889127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.716275585.0000000000E30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.715399968.00000000007C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.443445716.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635319 Sample: O1ySvN9SvL Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 34 www.viatempo.com 2->34 46 Snort IDS alert for network traffic 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 5 other signatures 2->52 12 O1ySvN9SvL.exe 19 2->12         started        signatures3 process4 file5 32 C:\Users\user\AppData\Local\Temp\zrztlh.exe, PE32 12->32 dropped 15 zrztlh.exe 12->15         started        process6 signatures7 64 Multi AV Scanner detection for dropped file 15->64 66 Tries to detect virtualization through RDTSC time measurements 15->66 18 zrztlh.exe 15->18         started        process8 signatures9 38 Modifies the context of a thread in another process (thread injection) 18->38 40 Maps a DLL or memory area into another process 18->40 42 Sample uses process hollowing technique 18->42 44 Queues an APC in another process (thread injection) 18->44 21 explorer.exe 18->21 injected process10 dnsIp11 36 www.savingshk.com 188.114.97.3, 49798, 80 CLOUDFLARENETUS European Union 21->36 54 System process connects to network (likely due to code injection or exploit) 21->54 56 Uses netstat to query active network connections and open ports 21->56 25 NETSTAT.EXE 21->25         started        signatures12 process13 signatures14 58 Modifies the context of a thread in another process (thread injection) 25->58 60 Maps a DLL or memory area into another process 25->60 62 Tries to detect virtualization through RDTSC time measurements 25->62 28 cmd.exe 1 25->28         started        process15 process16 30 conhost.exe 28->30         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.97.3
 www.savingshk.com European Union
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
www.viatempo.com 216.120.146.201 true
www.savingshk.com 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.savingshk.com/a5vu/?l2MHK=FVYX5&4hOD6=FXMAgLN/IrBd2h0A7KmJ0dUV04fd60Tmz3QO5NzukmZcmTlm3Sf9IrYXmxrDB/U5IQUf true
  • Avira URL Cloud: safe
 unknown
www.knoxvillehojo.com/a5vu/ true
  • Avira URL Cloud: malware
 low