Click to jump to signature section
Source: Yara match | File source: 14.2.vbfvrba.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 14.3.vbfvrba.5b0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.vbfvrba.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 14.2.vbfvrba.5a0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.file.exe.6c0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.3.vbfvrba.21b0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.vbfvrba.6e0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000E.00000002.458450131.00000000005B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000E.00000003.446586296.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.377030181.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000003.364685451.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.243844808.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.327792065.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000E.00000002.458781769.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.327822813.0000000000881000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.377400822.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000001.00000000.316092532.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: 0000000E.00000002.458450131.00000000005B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 0000000B.00000002.377030181.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 00000000.00000002.327668635.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown |
Source: 0000000E.00000002.458435299.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown |
Source: 0000000B.00000002.376837614.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown |
Source: 00000000.00000002.327792065.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 0000000E.00000002.458781769.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 00000000.00000002.327934318.00000000008BA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown |
Source: 0000000E.00000002.458600340.00000000005EE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown |
Source: 00000000.00000002.327822813.0000000000881000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 0000000B.00000002.377400822.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 00000001.00000000.316092532.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 0000000B.00000002.376742347.00000000005E9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown |
Source: 0000000E.00000002.458450131.00000000005B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 0000000B.00000002.377030181.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 00000000.00000002.327668635.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23 |
Source: 0000000E.00000002.458435299.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23 |
Source: 0000000B.00000002.376837614.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23 |
Source: 00000000.00000002.327792065.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 0000000E.00000002.458781769.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 00000000.00000002.327934318.00000000008BA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12 |
Source: 0000000E.00000002.458600340.00000000005EE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12 |
Source: 00000000.00000002.327822813.0000000000881000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 0000000B.00000002.377400822.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 00000001.00000000.316092532.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 0000000B.00000002.376742347.00000000005E9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0040180C Sleep,NtTerminateProcess, |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00401818 Sleep,NtTerminateProcess, |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00401822 Sleep,NtTerminateProcess, |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00401826 Sleep,NtTerminateProcess, |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00401834 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_0040180C Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_00401818 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_00401822 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_00401826 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_00401834 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_0040180C Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_00401818 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_00401822 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_00401826 Sleep,NtTerminateProcess, |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_00401834 Sleep,NtTerminateProcess, |
Source: C:\Windows\explorer.exe | Section loaded: taskschd.dll |
Source: C:\Windows\explorer.exe | Section loaded: dhcpcsvc6.dll |
Source: C:\Windows\explorer.exe | Section loaded: dhcpcsvc.dll |
Source: C:\Windows\explorer.exe | Section loaded: ondemandconnroutehelper.dll |
Source: C:\Windows\explorer.exe | Section loaded: webio.dll |
Source: C:\Windows\explorer.exe | Section loaded: mswsock.dll |
Source: C:\Windows\explorer.exe | Section loaded: winnsi.dll |
Source: C:\Windows\explorer.exe | Section loaded: ondemandconnroutehelper.dll |
Source: C:\Users\user\Desktop\file.exe | Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW; |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Unpacked PE file: 11.2.vbfvrba.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW; |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Unpacked PE file: 14.2.vbfvrba.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW; |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_004011D0 push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_004011D7 push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_004011EB push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_006B1252 push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_006B123E push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_006B1237 push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_008BFBB7 push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_008BFBCC push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_008CA9F2 push cs; iretd |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_008C4A56 pushad ; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_004011D0 push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_004011D7 push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_004011EB push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_006E1252 push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_006E123E push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_006E1237 push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_004011D0 push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_004011D7 push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_004011EB push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_005A1252 push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_005A123E push ebx; iretd |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_005A1237 push ebx; iretd |
Source: C:\Users\user\Desktop\file.exe | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\Desktop\file.exe | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\Desktop\file.exe | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\Desktop\file.exe | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\Desktop\file.exe | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\Desktop\file.exe | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Source: C:\Windows\explorer.exe TID: 5132 | Thread sleep count: 672 > 30 |
Source: C:\Windows\explorer.exe TID: 1932 | Thread sleep count: 412 > 30 |
Source: C:\Windows\explorer.exe TID: 1932 | Thread sleep time: -41200s >= -30000s |
Source: C:\Windows\explorer.exe TID: 5156 | Thread sleep count: 350 > 30 |
Source: C:\Windows\explorer.exe TID: 5156 | Thread sleep time: -35000s >= -30000s |
Source: C:\Windows\explorer.exe TID: 5892 | Thread sleep count: 576 > 30 |
Source: C:\Windows\explorer.exe TID: 6104 | Thread sleep count: 317 > 30 |
Source: C:\Windows\explorer.exe TID: 6104 | Thread sleep time: -31700s >= -30000s |
Source: C:\Windows\explorer.exe TID: 5880 | Thread sleep count: 248 > 30 |
Source: C:\Windows\explorer.exe TID: 5216 | Thread sleep count: 464 > 30 |
Source: C:\Windows\explorer.exe | Window / User API: threadDelayed 672 |
Source: C:\Windows\explorer.exe | Window / User API: threadDelayed 412 |
Source: C:\Windows\explorer.exe | Window / User API: threadDelayed 576 |
Source: C:\Windows\explorer.exe | Window / User API: threadDelayed 464 |
Source: explorer.exe, 00000001.00000000.264913549.0000000007AFF000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000 |
Source: explorer.exe, 00000001.00000000.325633709.0000000007B66000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000008 |
Source: explorer.exe, 00000001.00000000.271656643.000000000F278000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} |
Source: explorer.exe, 00000001.00000000.296837092.0000000007BB1000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} |
Source: explorer.exe, 00000001.00000000.259525432.0000000005EF4000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} |
Source: explorer.exe, 00000001.00000000.296837092.0000000007BB1000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}E2%d |
Source: explorer.exe, 00000001.00000000.291761489.0000000005F12000.00000004.00000001.00020000.00000000.sdmp | Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000 |
Source: C:\Users\user\Desktop\file.exe | System information queried: CodeIntegrityInformation |
Source: C:\Users\user\AppData\Roaming\vbfvrba | System information queried: CodeIntegrityInformation |
Source: C:\Users\user\AppData\Roaming\vbfvrba | System information queried: CodeIntegrityInformation |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_006B092B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_006B0D90 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_008BE81E push dword ptr fs:[00000030h] |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_006E092B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 11_2_006E0D90 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_005A092B mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Code function: 14_2_005A0D90 mov eax, dword ptr fs:[00000030h] |
Source: C:\Users\user\Desktop\file.exe | Process queried: DebugPort |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Process queried: DebugPort |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Process queried: DebugPort |
Source: C:\Users\user\Desktop\file.exe | Section loaded: unknown target: C:\Windows\explorer.exe protection: read write |
Source: C:\Users\user\Desktop\file.exe | Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Section loaded: unknown target: C:\Windows\explorer.exe protection: read write |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Section loaded: unknown target: C:\Windows\explorer.exe protection: read write |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read |
Source: C:\Users\user\Desktop\file.exe | Thread created: C:\Windows\explorer.exe EIP: 2671930 |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Thread created: unknown EIP: 2691930 |
Source: C:\Users\user\AppData\Roaming\vbfvrba | Thread created: unknown EIP: 4531930 |
Source: explorer.exe, 00000001.00000000.309348259.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.255414725.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.286060810.0000000000B10000.00000002.00000001.00040000.00000000.sdmp | Binary or memory string: Program Manager |
Source: explorer.exe, 00000001.00000000.296783129.0000000007B83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.325706644.0000000007B83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.309348259.0000000000B10000.00000002.00000001.00040000.00000000.sdmp | Binary or memory string: Shell_TrayWnd |
Source: explorer.exe, 00000001.00000000.308505060.00000000004C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.255215437.00000000004C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.309348259.0000000000B10000.00000002.00000001.00040000.00000000.sdmp | Binary or memory string: Progman |
Source: explorer.exe, 00000001.00000000.309348259.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.255414725.0000000000B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.286060810.0000000000B10000.00000002.00000001.00040000.00000000.sdmp | Binary or memory string: Progmanlock |
Source: Yara match | File source: 14.2.vbfvrba.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 14.3.vbfvrba.5b0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.vbfvrba.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 14.2.vbfvrba.5a0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.file.exe.6c0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.3.vbfvrba.21b0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.vbfvrba.6e0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000E.00000002.458450131.00000000005B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000E.00000003.446586296.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.377030181.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000003.364685451.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.243844808.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.327792065.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000E.00000002.458781769.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.327822813.0000000000881000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.377400822.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000001.00000000.316092532.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 14.2.vbfvrba.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 14.3.vbfvrba.5b0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.vbfvrba.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 14.2.vbfvrba.5a0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.3.file.exe.6c0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.3.vbfvrba.21b0000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.vbfvrba.6e0e67.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000E.00000002.458450131.00000000005B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000E.00000003.446586296.00000000005B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.377030181.00000000021F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000003.364685451.00000000021B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.243844808.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.327792065.0000000000860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000E.00000002.458781769.00000000021D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.327822813.0000000000881000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.377400822.0000000002231000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 00000001.00000000.316092532.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |