Source: 13.0.utisvaa.400000.2.unpack |
Avira: Label: TR/Crypt.ZPACK.Gen |
Source: 13.0.utisvaa.400000.1.unpack |
Avira: Label: TR/Crypt.ZPACK.Gen |
Source: 13.0.utisvaa.400000.0.unpack |
Avira: Label: TR/Crypt.ZPACK.Gen |
Source: 13.0.utisvaa.400000.3.unpack |
Avira: Label: TR/Crypt.ZPACK.Gen |
Source: Yara match |
File source: 0.2.P2SMn3jloH.exe.21b15a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.P2SMn3jloH.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.6.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.2.utisvaa.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 12.2.utisvaa.21a15a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0000000D.00000002.409013280.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.350515025.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.350312010.0000000000420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.408977758.0000000001F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000000.338679207.00000000057B1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: 0000000D.00000002.409013280.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 0000000C.00000002.395157811.00000000006D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown |
Source: 00000001.00000002.350515025.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 00000001.00000002.350312010.0000000000420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 0000000D.00000002.408977758.0000000001F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 00000002.00000000.338679207.00000000057B1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown |
Source: 00000000.00000002.254069978.00000000005E9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown |
Source: 0000000D.00000002.409013280.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 0000000C.00000002.395157811.00000000006D8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12 |
Source: 00000001.00000002.350515025.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 00000001.00000002.350312010.0000000000420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 0000000D.00000002.408977758.0000000001F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 00000002.00000000.338679207.00000000057B1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23 |
Source: 00000000.00000002.254069978.00000000005E9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_0041A8B0 |
0_2_0041A8B0 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_0040E970 |
0_2_0040E970 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00419918 |
0_2_00419918 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_004139A7 |
0_2_004139A7 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00414250 |
0_2_00414250 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00414A7C |
0_2_00414A7C |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00419220 |
0_2_00419220 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00418CDC |
0_2_00418CDC |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_0041B481 |
0_2_0041B481 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_0041465C |
0_2_0041465C |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00413E7C |
0_2_00413E7C |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00418798 |
0_2_00418798 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_021B0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess, |
0_2_021B0110 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_0040180C Sleep,NtTerminateProcess, |
1_2_0040180C |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_00401818 Sleep,NtTerminateProcess, |
1_2_00401818 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_00401822 Sleep,NtTerminateProcess, |
1_2_00401822 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_00401826 Sleep,NtTerminateProcess, |
1_2_00401826 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_00401834 Sleep,NtTerminateProcess, |
1_2_00401834 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 12_2_021A0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess, |
12_2_021A0110 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_0040180C Sleep,NtTerminateProcess, |
13_2_0040180C |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_00401818 Sleep,NtTerminateProcess, |
13_2_00401818 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_00401822 Sleep,NtTerminateProcess, |
13_2_00401822 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_00401826 Sleep,NtTerminateProcess, |
13_2_00401826 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_00401834 Sleep,NtTerminateProcess, |
13_2_00401834 |
Source: P2SMn3jloH.exe |
Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970 |
Source: utisvaa.2.dr |
Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970 |
Source: C:\Windows\explorer.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: webio.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\explorer.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: unknown |
Process created: C:\Users\user\Desktop\P2SMn3jloH.exe C:\Users\user\Desktop\P2SMn3jloH.exe |
|
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Process created: C:\Users\user\Desktop\P2SMn3jloH.exe C:\Users\user\Desktop\P2SMn3jloH.exe |
|
Source: unknown |
Process created: C:\Users\user\AppData\Roaming\utisvaa C:\Users\user\AppData\Roaming\utisvaa |
|
Source: C:\Users\user\AppData\Roaming\utisvaa |
Process created: C:\Users\user\AppData\Roaming\utisvaa C:\Users\user\AppData\Roaming\utisvaa |
|
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Process created: C:\Users\user\Desktop\P2SMn3jloH.exe C:\Users\user\Desktop\P2SMn3jloH.exe |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Process created: C:\Users\user\AppData\Roaming\utisvaa C:\Users\user\AppData\Roaming\utisvaa |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00405467 SetLastError,GetTickCount,LoadLibraryA,AreFileApisANSI,GetNamedPipeHandleStateW,InterlockedIncrement,EnterCriticalSection,GetConsoleAliasExesLengthW,EnumCalendarInfoW,InterlockedExchange,GetPrivateProfileStructA,EnterCriticalSection,InterlockedCompareExchange,EnumCalendarInfoA,LocalUnlock,CancelDeviceWakeupRequest,GetComputerNameW,EnterCriticalSection,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,InterlockedIncrement,GetCharWidthA,SetThreadToken,MoveFileWithProgressA,FindNextVolumeA,GetModuleHandleA,CreateActCtxW,VerifyVersionInfoA,InterlockedDecrement,InterlockedIncrement,MoveFileWithProgressA,WriteConsoleW,GlobalFindAtomW,LoadLibraryW,MoveFileWithProgressA,SetProcessAffinityMask,GetACP,DefineDosDeviceW,GetDiskFreeSpaceExW,InterlockedExchange,GetPrivateProfileStructW,LockFile,_lread,ReadConsoleInputW,GetPrivateProfileIntA,OpenJobObjectW,GetTapeParameters,GetMailslotInfo,CopyFileW,GetSystemWindowsDirectoryA,OpenFileMappingA,GetConsoleAliasesLengthA,SetFileTime, |
0_2_00405467 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00405224 CallNamedPipeA,GetThreadPriority,SearchPathA,OpenEventA,FindResourceW,GetVersionExA,SetWaitableTimer,CopyFileW,WriteConsoleInputA,SizeofResource,GlobalDeleteAtom,lstrlenW,GetModuleHandleA,GetWindowsDirectoryA,MapViewOfFileEx,GlobalGetAtomNameA,DebugBreak,LocalUnlock,VerifyVersionInfoW, |
0_2_00405224 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_004088F4 push eax; ret |
0_2_00408912 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_0040A483 push ecx; ret |
0_2_0040A496 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_0040EF7D push ecx; ret |
0_2_0040EF90 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_021B1970 push ebx; iretd |
0_2_021B19B7 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_021B1977 push ebx; iretd |
0_2_021B19B7 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_021B198B push ebx; iretd |
0_2_021B19B7 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_004011D0 push ebx; iretd |
1_2_00401217 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_004011D7 push ebx; iretd |
1_2_00401217 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 1_2_004011EB push ebx; iretd |
1_2_00401217 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 12_2_021A198B push ebx; iretd |
12_2_021A19B7 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 12_2_021A1970 push ebx; iretd |
12_2_021A19B7 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 12_2_021A1977 push ebx; iretd |
12_2_021A19B7 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_004011D0 push ebx; iretd |
13_2_00401217 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_004011D7 push ebx; iretd |
13_2_00401217 |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Code function: 13_2_004011EB push ebx; iretd |
13_2_00401217 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00417194 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, |
0_2_00417194 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI |
Jump to behavior |
Source: C:\Windows\explorer.exe TID: 2436 |
Thread sleep count: 627 > 30 |
Jump to behavior |
Source: C:\Windows\explorer.exe TID: 1172 |
Thread sleep count: 340 > 30 |
Jump to behavior |
Source: C:\Windows\explorer.exe TID: 1172 |
Thread sleep time: -34000s >= -30000s |
Jump to behavior |
Source: C:\Windows\explorer.exe TID: 2680 |
Thread sleep count: 355 > 30 |
Jump to behavior |
Source: C:\Windows\explorer.exe TID: 2680 |
Thread sleep time: -35500s >= -30000s |
Jump to behavior |
Source: C:\Windows\explorer.exe TID: 2136 |
Thread sleep count: 511 > 30 |
Jump to behavior |
Source: C:\Windows\explorer.exe TID: 5176 |
Thread sleep count: 217 > 30 |
Jump to behavior |
Source: explorer.exe, 00000002.00000000.313587656.00000000090D8000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}z, |
Source: explorer.exe, 00000002.00000000.313587656.00000000090D8000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000 |
Source: explorer.exe, 00000002.00000000.343231821.0000000007166000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}> |
Source: explorer.exe, 00000002.00000000.313587656.00000000090D8000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i, |
Source: explorer.exe, 00000002.00000000.312903359.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000001 ZG |
Source: explorer.exe, 00000002.00000000.266848734.0000000005063000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9' |
Source: explorer.exe, 00000002.00000000.312903359.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00417194 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, |
0_2_00417194 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00407933 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
0_2_00407933 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00408A87 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
0_2_00408A87 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_0040A40B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
0_2_0040A40B |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00410E4E SetUnhandledExceptionFilter, |
0_2_00410E4E |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00408F5F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
0_2_00408F5F |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Section loaded: unknown target: C:\Windows\explorer.exe protection: read write |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Section loaded: unknown target: C:\Windows\explorer.exe protection: read write |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\utisvaa |
Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read |
Jump to behavior |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_021B0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess, |
0_2_021B0110 |
Source: explorer.exe, 00000002.00000000.335292872.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.303168822.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.265409063.0000000001980000.00000002.00000001.00040000.00000000.sdmp |
Binary or memory string: Program ManagerT7<=ge |
Source: explorer.exe, 00000002.00000000.348886201.00000000090D8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.335292872.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.270117022.0000000006770000.00000004.00000001.00020000.00000000.sdmp |
Binary or memory string: Shell_TrayWnd |
Source: explorer.exe, 00000002.00000000.335292872.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.303168822.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.265409063.0000000001980000.00000002.00000001.00040000.00000000.sdmp |
Binary or memory string: Progman |
Source: explorer.exe, 00000002.00000000.265126182.0000000001378000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.302408124.0000000001378000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.333974747.0000000001378000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: CProgmanile |
Source: explorer.exe, 00000002.00000000.335292872.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.303168822.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.265409063.0000000001980000.00000002.00000001.00040000.00000000.sdmp |
Binary or memory string: Progmanlock |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP, |
0_2_0041325D |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA, |
0_2_00418265 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW, |
0_2_00418231 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement, |
0_2_00412B6A |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, |
0_2_00413374 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: GetLocaleInfoA, |
0_2_00411B01 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement, |
0_2_00409B37 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, |
0_2_004183A4 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen, |
0_2_0041340C |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, |
0_2_004124FC |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, |
0_2_00413480 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, |
0_2_00418541 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement, |
0_2_00412DC2 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, |
0_2_00413652 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: GetLocaleInfoA, |
0_2_00418691 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, |
0_2_0041377A |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, |
0_2_00413713 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW, |
0_2_00411FE0 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s, |
0_2_004137B6 |
Source: C:\Users\user\Desktop\P2SMn3jloH.exe |
Code function: 0_2_00405224 CallNamedPipeA,GetThreadPriority,SearchPathA,OpenEventA,FindResourceW,GetVersionExA,SetWaitableTimer,CopyFileW,WriteConsoleInputA,SizeofResource,GlobalDeleteAtom,lstrlenW,GetModuleHandleA,GetWindowsDirectoryA,MapViewOfFileEx,GlobalGetAtomNameA,DebugBreak,LocalUnlock,VerifyVersionInfoW, |
0_2_00405224 |
Source: Yara match |
File source: 0.2.P2SMn3jloH.exe.21b15a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.P2SMn3jloH.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.6.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.2.utisvaa.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 12.2.utisvaa.21a15a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0000000D.00000002.409013280.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.350515025.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.350312010.0000000000420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.408977758.0000000001F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000000.338679207.00000000057B1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0.2.P2SMn3jloH.exe.21b15a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.P2SMn3jloH.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.6.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.0.utisvaa.400000.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 13.2.utisvaa.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 12.2.utisvaa.21a15a0.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0000000D.00000002.409013280.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.350515025.0000000001F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.350312010.0000000000420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0000000D.00000002.408977758.0000000001F30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000000.338679207.00000000057B1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY |