Windows Analysis Report
Order 20233.exe

Overview

General Information

Sample Name: Order 20233.exe
Analysis ID: 780222
MD5: cfc3542e983b4a7436dabb73132cbbdb
SHA1: c792d80b3667badeef358a872cc5b548d9114151
SHA256: 614490e3bf7cf0672ecda890e33b49f4f8b80da18333111489284df04ab7d934
Tags: exeformbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected UAC Bypass using CMSTP
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
.NET source code contains very large strings
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
PE file does not import any functions
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Order 20233.exe ReversingLabs: Detection: 51%
Source: Order 20233.exe Virustotal: Detection: 40% Perma Link
Yara detected FormBook
Source: Yara match File source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.429045725.00000000017F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.ahmedo.ch/dcn0/?pFQ0Q=4h6DHJsXwPiPeVap&oRk4IZo0=C4IpA5iiNFvhwRpGGB75QVE24l/FHjdcJi1XKvHDvYafZRhhpOblpVmnT5Y5r50LceSQqf3teF0eh20kxL606x8yuiPd0JQ74w== Avira URL Cloud: Label: malware
Source: www.ahmedo.ch/dcn0/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: iamme-label.com Virustotal: Detection: 8% Perma Link
Source: www.ahmedo.ch/dcn0/ Virustotal: Detection: 9% Perma Link
Source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.ahmedo.ch/dcn0/"]}

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 0.2.Order 20233.exe.21700429a18.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Order 20233.exe PID: 5872, type: MEMORYSTR
Source: Order 20233.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: AddInProcess32.pdb source: mstsc.exe, 00000015.00000002.533525731.00000000054E3000.00000004.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000011.00000003.308531715.0000000001697000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.305774318.00000000014FF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000002.429111171.0000000001830000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.431126939.0000000005003000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.531941308.00000000051A0000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.428147207.0000000004E69000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.533058558.00000000052BF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000011.00000003.308531715.0000000001697000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.305774318.00000000014FF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000002.429111171.0000000001830000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.431126939.0000000005003000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.531941308.00000000051A0000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.428147207.0000000004E69000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.533058558.00000000052BF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: mstsc.pdbGCTL source: AddInProcess32.exe, 00000011.00000003.416107815.000000000386B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.420075103.0000000003BC4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: AddInProcess32.pdbpw source: mstsc.exe, 00000015.00000002.533525731.00000000054E3000.00000004.10000000.00040000.00000000.sdmp
Source: Binary string: c:\TeamCity\buildAgent\work\5644082abfe4d909\EFBuild\obj\Release\Migrate\migrate.pdb source: Order 20233.exe
Source: Binary string: mstsc.pdb source: AddInProcess32.exe, 00000011.00000003.416107815.000000000386B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.420075103.0000000003BC4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\agent\1\s\sys\x64\Release\ProcExpDriver.pdb source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 213.239.221.71 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.ahmedo.ch
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49698 -> 213.239.221.71:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49698 -> 213.239.221.71:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49698 -> 213.239.221.71:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.ahmedo.ch/dcn0/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dcn0/?pFQ0Q=4h6DHJsXwPiPeVap&oRk4IZo0=C4IpA5iiNFvhwRpGGB75QVE24l/FHjdcJi1XKvHDvYafZRhhpOblpVmnT5Y5r50LceSQqf3teF0eh20kxL606x8yuiPd0JQ74w== HTTP/1.1Host: www.ahmedo.chConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 213.239.221.71 213.239.221.71
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 08 Jan 2023 15:24:08 GMTContent-Type: text/html; charset=utf-8Content-Length: 254Connection: closeX-Varnish: 1006141483Retry-After: 5Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 20 20 3c 68 33 3e 47 75 72 75 20 4d 65 64 69 74 61 74 69 6f 6e 3a 3c 2f 68 33 3e 0a 20 20 20 20 3c 70 3e 58 49 44 3a 20 31 30 30 36 31 34 31 34 38 33 3c 2f 70 3e 0a 20 20 20 20 3c 68 72 3e 0a 20 20 20 20 3c 70 3e 56 61 72 6e 69 73 68 20 63 61 63 68 65 20 73 65 72 76 65 72 3c 2f 70 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html> <head> <title>404 Not Found</title> </head> <body> <h1>Error 404 Not Found</h1> <p>Not Found</p> <h3>Guru Meditation:</h3> <p>XID: 1006141483</p> <hr> <p>Varnish cache server</p> </body></html>
Source: 4184-48M.21.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 4184-48M.21.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 4184-48M.21.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mstsc.exe, 00000015.00000003.521808734.0000000001016000.00000004.00000020.00020000.00000000.sdmp, 4184-48M.21.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4184-48M.21.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mstsc.exe, 00000015.00000003.521808734.0000000001016000.00000004.00000020.00020000.00000000.sdmp, 4184-48M.21.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: mstsc.exe, 00000015.00000003.521808734.0000000001016000.00000004.00000020.00020000.00000000.sdmp, 4184-48M.21.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: mstsc.exe, 00000015.00000003.521808734.0000000001016000.00000004.00000020.00020000.00000000.sdmp, 4184-48M.21.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: mstsc.exe, 00000015.00000003.521808734.0000000001016000.00000004.00000020.00020000.00000000.sdmp, 4184-48M.21.dr String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: mstsc.exe, 00000015.00000003.521808734.0000000001016000.00000004.00000020.00020000.00000000.sdmp, 4184-48M.21.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.sysinternals.com0
Source: unknown DNS traffic detected: queries for: www.ahmedo.ch
Source: global traffic HTTP traffic detected: GET /dcn0/?pFQ0Q=4h6DHJsXwPiPeVap&oRk4IZo0=C4IpA5iiNFvhwRpGGB75QVE24l/FHjdcJi1XKvHDvYafZRhhpOblpVmnT5Y5r50LceSQqf3teF0eh20kxL606x8yuiPd0JQ74w== HTTP/1.1Host: www.ahmedo.chConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.429045725.00000000017F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.Order 20233.exe.21700429a18.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.Order 20233.exe.21700429a18.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.429045725.00000000017F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: AddInProcess32.exe PID: 4392, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: mstsc.exe PID: 5380, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Order 20233.exe
.NET source code contains very large strings
Source: Order 20233.exe, moabGi8lf8iend/moabGu5ss.cs Long String: Length: 602136
Yara signature match
Source: 0.2.Order 20233.exe.21700429a18.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.Order 20233.exe.21700429a18.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.429045725.00000000017F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: AddInProcess32.exe PID: 4392, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: mstsc.exe PID: 5380, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD3854F8 0_2_00007FFBAD3854F8
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD3830A0 0_2_00007FFBAD3830A0
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD3830B0 0_2_00007FFBAD3830B0
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD3948D9 0_2_00007FFBAD3948D9
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD38A969 0_2_00007FFBAD38A969
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD385588 0_2_00007FFBAD385588
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD38BD36 0_2_00007FFBAD38BD36
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD382FD0 0_2_00007FFBAD382FD0
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD38D285 0_2_00007FFBAD38D285
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD3854F0 0_2_00007FFBAD3854F0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185F900 17_2_0185F900
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01874120 17_2_01874120
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186B090 17_2_0186B090
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018820A0 17_2_018820A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019220A8 17_2_019220A8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019228EC 17_2_019228EC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911002 17_2_01911002
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0192E824 17_2_0192E824
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188EBB0 17_2_0188EBB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191DBD2 17_2_0191DBD2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019103DA 17_2_019103DA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01922B28 17_2_01922B28
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187AB40 17_2_0187AB40
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019222AE 17_2_019222AE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0190FA2B 17_2_0190FA2B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882581 17_2_01882581
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019225DD 17_2_019225DD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186D5E0 17_2_0186D5E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01922D07 17_2_01922D07
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01850D20 17_2_01850D20
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01921D55 17_2_01921D55
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186841F 17_2_0186841F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191D466 17_2_0191D466
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0192DFCE 17_2_0192DFCE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01921FF1 17_2_01921FF1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01922EF7 17_2_01922EF7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191D616 17_2_0191D616
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01876E30 17_2_01876E30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004012A7 17_2_004012A7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004223E6 17_2_004223E6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0040B443 17_2_0040B443
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0040B447 17_2_0040B447
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004044C0 17_2_004044C0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004044C7 17_2_004044C7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0040FE77 17_2_0040FE77
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004046E7 17_2_004046E7
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: String function: 0185B150 appears 45 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD39A0AD NtResumeThread, 0_2_00007FFBAD39A0AD
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD399F90 NtWriteVirtualMemory, 0_2_00007FFBAD399F90
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD39A538 NtResumeThread, 0_2_00007FFBAD39A538
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018999A0 NtCreateSection,LdrInitializeThunk, 17_2_018999A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899910 NtAdjustPrivilegesToken,LdrInitializeThunk, 17_2_01899910
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018998F0 NtReadVirtualMemory,LdrInitializeThunk, 17_2_018998F0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899840 NtDelayExecution,LdrInitializeThunk, 17_2_01899840
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899860 NtQuerySystemInformation,LdrInitializeThunk, 17_2_01899860
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899A00 NtProtectVirtualMemory,LdrInitializeThunk, 17_2_01899A00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899A20 NtResumeThread,LdrInitializeThunk, 17_2_01899A20
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899A50 NtCreateFile,LdrInitializeThunk, 17_2_01899A50
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018995D0 NtClose,LdrInitializeThunk, 17_2_018995D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899540 NtReadFile,LdrInitializeThunk, 17_2_01899540
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899780 NtMapViewOfSection,LdrInitializeThunk, 17_2_01899780
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018997A0 NtUnmapViewOfSection,LdrInitializeThunk, 17_2_018997A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899FE0 NtCreateMutant,LdrInitializeThunk, 17_2_01899FE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899710 NtQueryInformationToken,LdrInitializeThunk, 17_2_01899710
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018996E0 NtFreeVirtualMemory,LdrInitializeThunk, 17_2_018996E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899660 NtAllocateVirtualMemory,LdrInitializeThunk, 17_2_01899660
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018999D0 NtCreateProcessEx, 17_2_018999D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899950 NtQueueApcThread, 17_2_01899950
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018998A0 NtWriteVirtualMemory, 17_2_018998A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899820 NtEnumerateKey, 17_2_01899820
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0189B040 NtSuspendThread, 17_2_0189B040
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0189A3B0 NtGetContextThread, 17_2_0189A3B0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899B00 NtSetValueKey, 17_2_01899B00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899A80 NtOpenDirectoryObject, 17_2_01899A80
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899A10 NtQuerySection, 17_2_01899A10
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018995F0 NtQueryInformationFile, 17_2_018995F0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899520 NtWaitForSingleObject, 17_2_01899520
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0189AD30 NtSetContextThread, 17_2_0189AD30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899560 NtWriteFile, 17_2_01899560
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0189A710 NtOpenProcessToken, 17_2_0189A710
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899730 NtQueryVirtualMemory, 17_2_01899730
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899760 NtOpenProcess, 17_2_01899760
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0189A770 NtOpenThread, 17_2_0189A770
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899770 NtSetInformationFile, 17_2_01899770
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018996D0 NtCreateKey, 17_2_018996D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899610 NtEnumerateValueKey, 17_2_01899610
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899650 NtQueryValueKey, 17_2_01899650
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01899670 NtQueryInformationProcess, 17_2_01899670
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041E097 NtAllocateVirtualMemory, 17_2_0041E097
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004012A7 NtProtectVirtualMemory, 17_2_004012A7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041DEB7 NtCreateFile, 17_2_0041DEB7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041DF67 NtReadFile, 17_2_0041DF67
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041DFE7 NtClose, 17_2_0041DFE7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041E091 NtAllocateVirtualMemory, 17_2_0041E091
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004014E9 NtProtectVirtualMemory, 17_2_004014E9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041DEB1 NtCreateFile, 17_2_0041DEB1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041DFE2 NtClose, 17_2_0041DFE2
PE file does not import any functions
Source: Order 20233.exe Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: Order 20233.exe, 00000000.00000002.316784972.00000217728BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Order 20233.exe
Source: Order 20233.exe, 00000000.00000002.317830281.00000217742B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameRunpeX.Stub.Framework.exeL vs Order 20233.exe
Source: Order 20233.exe, 00000000.00000002.312683792.0000021710011000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRunpeX.Stub.Framework.exeL vs Order 20233.exe
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprocexp.SysB vs Order 20233.exe
Source: Order 20233.exe ReversingLabs: Detection: 51%
Source: Order 20233.exe Virustotal: Detection: 40%
Source: Order 20233.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Order 20233.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Order 20233.exe C:\Users\user\Desktop\Order 20233.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Order 20233.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File created: C:\Users\user\AppData\Local\Temp\4184-48M Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@22/2@2/1
Source: Order 20233.exe Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
Source: C:\Users\user\Desktop\Order 20233.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: Order 20233.exe, moabGi8lf8iend/moabGu5ss.cs Base64 encoded string: 'Jr0xBz+D+BELGing3agbwsAiJOAQiCxuo8V9PAF/wB9EXrxYPhbXm/9FZtg67D4Pu5gkIVh2Jt0Z0mfXiLyT7qEBYe/8i8zpbJYUZP2dX/pJ5zXISHZ9mD+skozjHoqZYOFGs+6gMw/Gf66pqYSKc+6V6t3+zbYnJczVBRi+pPZoCWhxuiTU+IfihPJhzit4wnx9uXqKB1rEdLoF0LOATjSCOziQQ14gxzGP4L7hVCsKybhqIG8Dd+1rFp21TshLOrLTVd37HEVMT1/4QRXI/BclrpWkv6mIuWefL6cQ5dTzM+zcGZ4Ggy0HGqzOdNGMjAaf1euDFGL51KFGQNpLGafNVim6FJbLl75St+6y1nMKkXRrbgs2QtiuwTLGmc84RF68WD4W15v/RWbYOuw+D0RevFg+Fteb/0Vm2DrsPg9EXrxYPhbXm/9FZtg67D4PRF68WD4W15v/RWbYOuw+D0RevFg+Fteb/0Vm2DrsPg9vNXSMmjRXsWUcjcFx6HlNqOo3bXIF94qAeyFKNv4UdfW0JQHIh7RQx3ufFu4qrkXdvrzcqIM7EvDg6ZcaOoPFwgVspZ6/1FVuO0NMF2Bojy5aXe893GVf4xKTVgSbStSJN/W1P/arSFPDPbmfKC+nRF68WD4W15v/RWbYOuw+D0RevFg+Fteb/0Vm2DrsPg+IjShPa6MqIjcJVxubYZHFFl18fIuZLxmY5SogkctNqkRevFg+Fteb/0Vm2DrsPg9EXrxYPhbXm/9FZtg67D4PP7m4exSTdy5g9ph8fIHPMuS/L9Xl2jIfNrh8PMfCDOO9OK0p6NBowlTXt6ko7ND53D14FQDMeIy2EmvL9dcSpGLpXd6IGbHPZgpLOXcBsTVFYV4r8ktGmTk3Kal8GmbrSNaKf9gSGC9QCjtaglNj/Rrzux/WptmXrkggyARXV31OR9qr26v/HUfczrp2BWnActzRK5v/iYAhq2EdWkjsISk6IdBjb6k1/trfTcVcMZ6PxCHcB8evEZBqGBZRdl30qGLfwZiEVEo66Mj5ES9Vv95N10txq+daeKH2ox1bD7DPBtMF0DR6SIReu3NAbBdi9dofkCR9rD5WcxwWUECtqKh5ylV6Xyura3e7HZBCctPpsY9KTQ6ks/Jlq+7x91e7TH4XPA9sxPVpyK5Vqbm7EJ3VgbuvuZM/MkPc9tG4JbiNzLqo6rUWP1UkIuMzO1vMCUyYpXkBu9twDwqwonjSUQBIs/guI+szq1iNDQdkhjVK5qzMnLoCdQ6GfnH/yB9QGLkRPbzSRdltX/wxLr0OEMNTsNGMaH9tskvdJFhNvSTjNZdEPejI5SdAJsU/Woy0sL1eTNizHsnQjlKKtuaVxlSuYvnBNk71I/RatuZ46vqvutQ1O+1PLfRgn1MVaQuxV+nQY8EM4tid7HWd2Xzyqeq1Bb0b92Mb9F+UZhgqBsuuhyREUVk1OKmTtAa09hk4w6jub8gV1H/GxKYvl2Z/InWFo8LYVj+3EFYVrflA8PyvtLTTLYlAVkF9x5SyV3IcTls9BqVw0lad13OMJgbnFsB8rkkKxXQko/kB7LECbvyLkXQXiGTIcLadkjgHWo5iALZr705SKnsuQm+hzGvN+OWiGLFnUGwPQSWFFW9hiPGOQZeza6fptCg5HWbSSmxwBLOg9++ygql8F1gF/2fJgWEIgcsNzRc0nFveeSVId63avstX0jCiMRcs0BN7YmuwUFrZW6Som5FmB9hOHAkKYnM6um6LgAaFT4TCJk8PqQMRkKyydFsOX9Ug3Il2wK1UL6htE2vqT70KMrb2ovY1bw1Sm+VM6r8khQPXDmCdlvhdl3a7zJVN/32RGoXUtTftW9/hbKJHoxiBC0+vwqnIRWqodcfnyie8yevlU/Jmkg1e0lNKBTYbOTExyT9VArNlW1hScYhPtzlUn2h+qdKVq7YXcN+HmGxB1fs/etzThQNk7+JWwAKfBh7Aqj+efbL6WO1nrvw3Q7xVag+9Hkj8n9lxwT5S32mrwOZtG71MFWHYIdg6gDM7qehCVWSoDEXRJxk5BZW8aOui4HIuUamxafGJMnEpu2lXjJzXJ9D4hwSgCy9ukpVrpEuVbkFwlAdTBY5StrYhqRRZ1pYUVq0EmPc55R3XWw/BFbzwrx80kYQ37VQGkpDslX5sXfx8RpdhvVqdGtq3H5dRLC0Y9q7mzjeoxW+DcnZtuqtnKRW2I+n1Tnw4MwFw73Q/IGtcdGaVuLBNpW4EqXi9f2M0YtdG2tlDKuUCoB3eFPG6fyOf5+nQGosH7vfnMEpU1f+paIXNd/Dt1EyGfp07Bu4dMN/dyn2z07w46Z0MgYDOuELiagUlwxxIQy5R1QaEs+hxpGEfSbkZHwug2g9BgKPxCn71go1bqcoZp9LDI79NYr6Nh677MiCmE4pfZ/LvEtqH+cU9hgC1YZIPSsypXKgVFexFQUBwkMPwgx4WzOdfp3teElc15qeroeYN6+Y5bvudEvPLrpTUfNBGGJKV4uzqFMFWY9R3ecHN1msI1FHiPj4a0+ewdYLrG/UzEitTLVJYaKCP2TWMnBfSp6B5m+egRqpip3AEVmYPM53PTGbK49LxfdNCm2s19K8KcH3Tc8vpW3LU/PYYSmuW0EibVkFFSdaeA6uAgnMTZ5RA8PAy7J0qT0igYRdGt9bOaxIAW8mn36EB8kAtPEtrMHfh7IIjhDBWsQRzGzDjs8lZ60c2HX52dLleI8ArkkGJQpACOCZaIGDC9k/3R0W9sJb60cw5fTrtQC0Zgo74QVHctpFnrvqmP+KFWf7o6A1eswjHJ1vOgpc37wvkMfeWwiXJgdwLo0GREJQphgd5COG5qx65NTqguxc+yvMbe/NOUpadv5RNNnaUKdVKszW88kV9xvpiPuenB/2TKGc86Twl6W7z8GABGPkwVDMJkQOyc3omUv2kLVnsMjd9K7JdukBIzvTAvCGe4fVbeQ7K/RWwvrjHrsAW2OKYxJouvVknRTc
Source: Order 20233.exe, moabDefe1da1t/moab0ecade.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Order 20233.exe, moabDefe1da1t/moab0ecade.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Order 20233.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: C:\Windows\SysWOW64\mstsc.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Order 20233.exe Static file information: File size 1827328 > 1048576
Source: Order 20233.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Order 20233.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1bde00
Source: Order 20233.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Order 20233.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: AddInProcess32.pdb source: mstsc.exe, 00000015.00000002.533525731.00000000054E3000.00000004.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000011.00000003.308531715.0000000001697000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.305774318.00000000014FF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000002.429111171.0000000001830000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.431126939.0000000005003000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.531941308.00000000051A0000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.428147207.0000000004E69000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.533058558.00000000052BF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000011.00000003.308531715.0000000001697000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.305774318.00000000014FF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000002.429111171.0000000001830000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.431126939.0000000005003000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.531941308.00000000051A0000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000003.428147207.0000000004E69000.00000004.00000800.00020000.00000000.sdmp, mstsc.exe, 00000015.00000002.533058558.00000000052BF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: mstsc.pdbGCTL source: AddInProcess32.exe, 00000011.00000003.416107815.000000000386B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.420075103.0000000003BC4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: AddInProcess32.pdbpw source: mstsc.exe, 00000015.00000002.533525731.00000000054E3000.00000004.10000000.00040000.00000000.sdmp
Source: Binary string: c:\TeamCity\buildAgent\work\5644082abfe4d909\EFBuild\obj\Release\Migrate\migrate.pdb source: Order 20233.exe
Source: Binary string: mstsc.pdb source: AddInProcess32.exe, 00000011.00000003.416107815.000000000386B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000011.00000003.420075103.0000000003BC4000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\agent\1\s\sys\x64\Release\ProcExpDriver.pdb source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_000002177258A635 pushfq ; retf 0_2_000002177258A636
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD3881DE push eax; ret 0_2_00007FFBAD3881ED
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD3881C3 pushad ; ret 0_2_00007FFBAD3881DD
Source: C:\Users\user\Desktop\Order 20233.exe Code function: 0_2_00007FFBAD387F17 push ebx; ret 0_2_00007FFBAD387F1A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018AD0D1 push ecx; ret 17_2_018AD0E4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004210F9 push eax; ret 17_2_004210FF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0040A0FE push ds; ret 17_2_0040A104
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004210AC push eax; ret 17_2_004210FF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_00421163 push eax; ret 17_2_00421169
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_00421102 push eax; ret 17_2_00421169
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_004082D9 pushad ; ret 17_2_004082DB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041B2F7 push edi; ret 17_2_0041B319
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041AA83 push ecx; ret 17_2_0041AA8A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0040CAAF pushad ; ret 17_2_0040CAB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041AABE push ebx; ret 17_2_0041AABF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041AB17 push edx; retf 17_2_0041AB26
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0041AC8C push es; retf 17_2_0041AC8D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_00419F2C pushfd ; ret 17_2_00419F2D
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Order 20233.exe PID: 5872, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Order 20233.exe TID: 6048 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01886B90 rdtsc 17_2_01886B90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Order 20233.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe API coverage: 8.3 %
Source: C:\Users\user\Desktop\Order 20233.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: explorer.exe, 00000014.00000000.332547025.00000000090D8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}z,
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Order 20233.exe Binary or memory string: krW0yvrDWyLEsalvv9+gJn4HXY2Vl3oUSouBYpABUpILCnMKeZOCp4tGtHKoVCk8NpdWGHrn5rVTmS77oiljOkKoFUpHgfs9AD+dv7F0vkXKD8MG11HzATdEKuZ0Wj8hJq
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: explorer.exe, 00000014.00000000.359291499.0000000007166000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000014.00000000.332547025.00000000090D8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: explorer.exe, 00000014.00000000.366252688.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000001 ZG
Source: explorer.exe, 00000014.00000000.332547025.00000000090D8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i,
Source: explorer.exe, 00000014.00000000.354585161.0000000005063000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9'
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Order 20233.exe, 00000000.00000002.307240317.00000217000D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000014.00000000.366252688.0000000008FE9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01886B90 rdtsc 17_2_01886B90
Enables debug privileges
Source: C:\Users\user\Desktop\Order 20233.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187C182 mov eax, dword ptr fs:[00000030h] 17_2_0187C182
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188A185 mov eax, dword ptr fs:[00000030h] 17_2_0188A185
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882990 mov eax, dword ptr fs:[00000030h] 17_2_01882990
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018861A0 mov eax, dword ptr fs:[00000030h] 17_2_018861A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018861A0 mov eax, dword ptr fs:[00000030h] 17_2_018861A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D69A6 mov eax, dword ptr fs:[00000030h] 17_2_018D69A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D51BE mov eax, dword ptr fs:[00000030h] 17_2_018D51BE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D51BE mov eax, dword ptr fs:[00000030h] 17_2_018D51BE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D51BE mov eax, dword ptr fs:[00000030h] 17_2_018D51BE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D51BE mov eax, dword ptr fs:[00000030h] 17_2_018D51BE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019149A4 mov eax, dword ptr fs:[00000030h] 17_2_019149A4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019149A4 mov eax, dword ptr fs:[00000030h] 17_2_019149A4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019149A4 mov eax, dword ptr fs:[00000030h] 17_2_019149A4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019149A4 mov eax, dword ptr fs:[00000030h] 17_2_019149A4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185B1E1 mov eax, dword ptr fs:[00000030h] 17_2_0185B1E1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185B1E1 mov eax, dword ptr fs:[00000030h] 17_2_0185B1E1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185B1E1 mov eax, dword ptr fs:[00000030h] 17_2_0185B1E1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018E41E8 mov eax, dword ptr fs:[00000030h] 17_2_018E41E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859100 mov eax, dword ptr fs:[00000030h] 17_2_01859100
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859100 mov eax, dword ptr fs:[00000030h] 17_2_01859100
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859100 mov eax, dword ptr fs:[00000030h] 17_2_01859100
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01874120 mov eax, dword ptr fs:[00000030h] 17_2_01874120
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01874120 mov eax, dword ptr fs:[00000030h] 17_2_01874120
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01874120 mov eax, dword ptr fs:[00000030h] 17_2_01874120
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01874120 mov eax, dword ptr fs:[00000030h] 17_2_01874120
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01874120 mov ecx, dword ptr fs:[00000030h] 17_2_01874120
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188513A mov eax, dword ptr fs:[00000030h] 17_2_0188513A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188513A mov eax, dword ptr fs:[00000030h] 17_2_0188513A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187B944 mov eax, dword ptr fs:[00000030h] 17_2_0187B944
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187B944 mov eax, dword ptr fs:[00000030h] 17_2_0187B944
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185C962 mov eax, dword ptr fs:[00000030h] 17_2_0185C962
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185B171 mov eax, dword ptr fs:[00000030h] 17_2_0185B171
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185B171 mov eax, dword ptr fs:[00000030h] 17_2_0185B171
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859080 mov eax, dword ptr fs:[00000030h] 17_2_01859080
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D3884 mov eax, dword ptr fs:[00000030h] 17_2_018D3884
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D3884 mov eax, dword ptr fs:[00000030h] 17_2_018D3884
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018990AF mov eax, dword ptr fs:[00000030h] 17_2_018990AF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018820A0 mov eax, dword ptr fs:[00000030h] 17_2_018820A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018820A0 mov eax, dword ptr fs:[00000030h] 17_2_018820A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018820A0 mov eax, dword ptr fs:[00000030h] 17_2_018820A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018820A0 mov eax, dword ptr fs:[00000030h] 17_2_018820A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018820A0 mov eax, dword ptr fs:[00000030h] 17_2_018820A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018820A0 mov eax, dword ptr fs:[00000030h] 17_2_018820A0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188F0BF mov ecx, dword ptr fs:[00000030h] 17_2_0188F0BF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188F0BF mov eax, dword ptr fs:[00000030h] 17_2_0188F0BF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188F0BF mov eax, dword ptr fs:[00000030h] 17_2_0188F0BF
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EB8D0 mov eax, dword ptr fs:[00000030h] 17_2_018EB8D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EB8D0 mov ecx, dword ptr fs:[00000030h] 17_2_018EB8D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EB8D0 mov eax, dword ptr fs:[00000030h] 17_2_018EB8D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EB8D0 mov eax, dword ptr fs:[00000030h] 17_2_018EB8D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EB8D0 mov eax, dword ptr fs:[00000030h] 17_2_018EB8D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EB8D0 mov eax, dword ptr fs:[00000030h] 17_2_018EB8D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018540E1 mov eax, dword ptr fs:[00000030h] 17_2_018540E1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018540E1 mov eax, dword ptr fs:[00000030h] 17_2_018540E1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018540E1 mov eax, dword ptr fs:[00000030h] 17_2_018540E1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018558EC mov eax, dword ptr fs:[00000030h] 17_2_018558EC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01924015 mov eax, dword ptr fs:[00000030h] 17_2_01924015
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01924015 mov eax, dword ptr fs:[00000030h] 17_2_01924015
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D7016 mov eax, dword ptr fs:[00000030h] 17_2_018D7016
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D7016 mov eax, dword ptr fs:[00000030h] 17_2_018D7016
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D7016 mov eax, dword ptr fs:[00000030h] 17_2_018D7016
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188002D mov eax, dword ptr fs:[00000030h] 17_2_0188002D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188002D mov eax, dword ptr fs:[00000030h] 17_2_0188002D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188002D mov eax, dword ptr fs:[00000030h] 17_2_0188002D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188002D mov eax, dword ptr fs:[00000030h] 17_2_0188002D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188002D mov eax, dword ptr fs:[00000030h] 17_2_0188002D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186B02A mov eax, dword ptr fs:[00000030h] 17_2_0186B02A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186B02A mov eax, dword ptr fs:[00000030h] 17_2_0186B02A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186B02A mov eax, dword ptr fs:[00000030h] 17_2_0186B02A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186B02A mov eax, dword ptr fs:[00000030h] 17_2_0186B02A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01870050 mov eax, dword ptr fs:[00000030h] 17_2_01870050
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01870050 mov eax, dword ptr fs:[00000030h] 17_2_01870050
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01912073 mov eax, dword ptr fs:[00000030h] 17_2_01912073
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01921074 mov eax, dword ptr fs:[00000030h] 17_2_01921074
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01861B8F mov eax, dword ptr fs:[00000030h] 17_2_01861B8F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01861B8F mov eax, dword ptr fs:[00000030h] 17_2_01861B8F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0190D380 mov ecx, dword ptr fs:[00000030h] 17_2_0190D380
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188B390 mov eax, dword ptr fs:[00000030h] 17_2_0188B390
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191138A mov eax, dword ptr fs:[00000030h] 17_2_0191138A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882397 mov eax, dword ptr fs:[00000030h] 17_2_01882397
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01884BAD mov eax, dword ptr fs:[00000030h] 17_2_01884BAD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01884BAD mov eax, dword ptr fs:[00000030h] 17_2_01884BAD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01884BAD mov eax, dword ptr fs:[00000030h] 17_2_01884BAD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01925BA5 mov eax, dword ptr fs:[00000030h] 17_2_01925BA5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D53CA mov eax, dword ptr fs:[00000030h] 17_2_018D53CA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D53CA mov eax, dword ptr fs:[00000030h] 17_2_018D53CA
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018803E2 mov eax, dword ptr fs:[00000030h] 17_2_018803E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018803E2 mov eax, dword ptr fs:[00000030h] 17_2_018803E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018803E2 mov eax, dword ptr fs:[00000030h] 17_2_018803E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018803E2 mov eax, dword ptr fs:[00000030h] 17_2_018803E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018803E2 mov eax, dword ptr fs:[00000030h] 17_2_018803E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018803E2 mov eax, dword ptr fs:[00000030h] 17_2_018803E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187DBE9 mov eax, dword ptr fs:[00000030h] 17_2_0187DBE9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191131B mov eax, dword ptr fs:[00000030h] 17_2_0191131B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185DB40 mov eax, dword ptr fs:[00000030h] 17_2_0185DB40
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01928B58 mov eax, dword ptr fs:[00000030h] 17_2_01928B58
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185F358 mov eax, dword ptr fs:[00000030h] 17_2_0185F358
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185DB60 mov ecx, dword ptr fs:[00000030h] 17_2_0185DB60
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01883B7A mov eax, dword ptr fs:[00000030h] 17_2_01883B7A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01883B7A mov eax, dword ptr fs:[00000030h] 17_2_01883B7A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188D294 mov eax, dword ptr fs:[00000030h] 17_2_0188D294
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188D294 mov eax, dword ptr fs:[00000030h] 17_2_0188D294
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018552A5 mov eax, dword ptr fs:[00000030h] 17_2_018552A5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018552A5 mov eax, dword ptr fs:[00000030h] 17_2_018552A5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018552A5 mov eax, dword ptr fs:[00000030h] 17_2_018552A5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018552A5 mov eax, dword ptr fs:[00000030h] 17_2_018552A5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018552A5 mov eax, dword ptr fs:[00000030h] 17_2_018552A5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186AAB0 mov eax, dword ptr fs:[00000030h] 17_2_0186AAB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186AAB0 mov eax, dword ptr fs:[00000030h] 17_2_0186AAB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188FAB0 mov eax, dword ptr fs:[00000030h] 17_2_0188FAB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882ACB mov eax, dword ptr fs:[00000030h] 17_2_01882ACB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882AE4 mov eax, dword ptr fs:[00000030h] 17_2_01882AE4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191AA16 mov eax, dword ptr fs:[00000030h] 17_2_0191AA16
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191AA16 mov eax, dword ptr fs:[00000030h] 17_2_0191AA16
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01868A0A mov eax, dword ptr fs:[00000030h] 17_2_01868A0A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185AA16 mov eax, dword ptr fs:[00000030h] 17_2_0185AA16
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185AA16 mov eax, dword ptr fs:[00000030h] 17_2_0185AA16
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01855210 mov eax, dword ptr fs:[00000030h] 17_2_01855210
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01855210 mov ecx, dword ptr fs:[00000030h] 17_2_01855210
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01855210 mov eax, dword ptr fs:[00000030h] 17_2_01855210
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01855210 mov eax, dword ptr fs:[00000030h] 17_2_01855210
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01873A1C mov eax, dword ptr fs:[00000030h] 17_2_01873A1C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01894A2C mov eax, dword ptr fs:[00000030h] 17_2_01894A2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01894A2C mov eax, dword ptr fs:[00000030h] 17_2_01894A2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191EA55 mov eax, dword ptr fs:[00000030h] 17_2_0191EA55
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859240 mov eax, dword ptr fs:[00000030h] 17_2_01859240
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859240 mov eax, dword ptr fs:[00000030h] 17_2_01859240
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859240 mov eax, dword ptr fs:[00000030h] 17_2_01859240
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01859240 mov eax, dword ptr fs:[00000030h] 17_2_01859240
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018E4257 mov eax, dword ptr fs:[00000030h] 17_2_018E4257
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0190B260 mov eax, dword ptr fs:[00000030h] 17_2_0190B260
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0190B260 mov eax, dword ptr fs:[00000030h] 17_2_0190B260
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01928A62 mov eax, dword ptr fs:[00000030h] 17_2_01928A62
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0189927A mov eax, dword ptr fs:[00000030h] 17_2_0189927A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882581 mov eax, dword ptr fs:[00000030h] 17_2_01882581
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882581 mov eax, dword ptr fs:[00000030h] 17_2_01882581
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882581 mov eax, dword ptr fs:[00000030h] 17_2_01882581
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01882581 mov eax, dword ptr fs:[00000030h] 17_2_01882581
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01852D8A mov eax, dword ptr fs:[00000030h] 17_2_01852D8A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01852D8A mov eax, dword ptr fs:[00000030h] 17_2_01852D8A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01852D8A mov eax, dword ptr fs:[00000030h] 17_2_01852D8A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01852D8A mov eax, dword ptr fs:[00000030h] 17_2_01852D8A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01852D8A mov eax, dword ptr fs:[00000030h] 17_2_01852D8A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188FD9B mov eax, dword ptr fs:[00000030h] 17_2_0188FD9B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188FD9B mov eax, dword ptr fs:[00000030h] 17_2_0188FD9B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018835A1 mov eax, dword ptr fs:[00000030h] 17_2_018835A1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01881DB5 mov eax, dword ptr fs:[00000030h] 17_2_01881DB5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01881DB5 mov eax, dword ptr fs:[00000030h] 17_2_01881DB5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01881DB5 mov eax, dword ptr fs:[00000030h] 17_2_01881DB5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019205AC mov eax, dword ptr fs:[00000030h] 17_2_019205AC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019205AC mov eax, dword ptr fs:[00000030h] 17_2_019205AC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6DC9 mov eax, dword ptr fs:[00000030h] 17_2_018D6DC9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6DC9 mov eax, dword ptr fs:[00000030h] 17_2_018D6DC9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6DC9 mov eax, dword ptr fs:[00000030h] 17_2_018D6DC9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6DC9 mov ecx, dword ptr fs:[00000030h] 17_2_018D6DC9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6DC9 mov eax, dword ptr fs:[00000030h] 17_2_018D6DC9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6DC9 mov eax, dword ptr fs:[00000030h] 17_2_018D6DC9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01908DF1 mov eax, dword ptr fs:[00000030h] 17_2_01908DF1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186D5E0 mov eax, dword ptr fs:[00000030h] 17_2_0186D5E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186D5E0 mov eax, dword ptr fs:[00000030h] 17_2_0186D5E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0191FDE2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0191FDE2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0191FDE2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0191FDE2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01928D34 mov eax, dword ptr fs:[00000030h] 17_2_01928D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191E539 mov eax, dword ptr fs:[00000030h] 17_2_0191E539
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01863D34 mov eax, dword ptr fs:[00000030h] 17_2_01863D34
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01884D3B mov eax, dword ptr fs:[00000030h] 17_2_01884D3B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01884D3B mov eax, dword ptr fs:[00000030h] 17_2_01884D3B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01884D3B mov eax, dword ptr fs:[00000030h] 17_2_01884D3B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185AD30 mov eax, dword ptr fs:[00000030h] 17_2_0185AD30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018DA537 mov eax, dword ptr fs:[00000030h] 17_2_018DA537
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01893D43 mov eax, dword ptr fs:[00000030h] 17_2_01893D43
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D3540 mov eax, dword ptr fs:[00000030h] 17_2_018D3540
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01903D40 mov eax, dword ptr fs:[00000030h] 17_2_01903D40
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01877D50 mov eax, dword ptr fs:[00000030h] 17_2_01877D50
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187C577 mov eax, dword ptr fs:[00000030h] 17_2_0187C577
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187C577 mov eax, dword ptr fs:[00000030h] 17_2_0187C577
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186849B mov eax, dword ptr fs:[00000030h] 17_2_0186849B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01928CD6 mov eax, dword ptr fs:[00000030h] 17_2_01928CD6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_019114FB mov eax, dword ptr fs:[00000030h] 17_2_019114FB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6CF0 mov eax, dword ptr fs:[00000030h] 17_2_018D6CF0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6CF0 mov eax, dword ptr fs:[00000030h] 17_2_018D6CF0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6CF0 mov eax, dword ptr fs:[00000030h] 17_2_018D6CF0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6C0A mov eax, dword ptr fs:[00000030h] 17_2_018D6C0A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6C0A mov eax, dword ptr fs:[00000030h] 17_2_018D6C0A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6C0A mov eax, dword ptr fs:[00000030h] 17_2_018D6C0A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D6C0A mov eax, dword ptr fs:[00000030h] 17_2_018D6C0A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911C06 mov eax, dword ptr fs:[00000030h] 17_2_01911C06
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0192740D mov eax, dword ptr fs:[00000030h] 17_2_0192740D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0192740D mov eax, dword ptr fs:[00000030h] 17_2_0192740D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0192740D mov eax, dword ptr fs:[00000030h] 17_2_0192740D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188BC2C mov eax, dword ptr fs:[00000030h] 17_2_0188BC2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188A44B mov eax, dword ptr fs:[00000030h] 17_2_0188A44B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EC450 mov eax, dword ptr fs:[00000030h] 17_2_018EC450
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EC450 mov eax, dword ptr fs:[00000030h] 17_2_018EC450
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187746D mov eax, dword ptr fs:[00000030h] 17_2_0187746D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01868794 mov eax, dword ptr fs:[00000030h] 17_2_01868794
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D7794 mov eax, dword ptr fs:[00000030h] 17_2_018D7794
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D7794 mov eax, dword ptr fs:[00000030h] 17_2_018D7794
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D7794 mov eax, dword ptr fs:[00000030h] 17_2_018D7794
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018937F5 mov eax, dword ptr fs:[00000030h] 17_2_018937F5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188A70E mov eax, dword ptr fs:[00000030h] 17_2_0188A70E
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188A70E mov eax, dword ptr fs:[00000030h] 17_2_0188A70E
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187F716 mov eax, dword ptr fs:[00000030h] 17_2_0187F716
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EFF10 mov eax, dword ptr fs:[00000030h] 17_2_018EFF10
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EFF10 mov eax, dword ptr fs:[00000030h] 17_2_018EFF10
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0192070D mov eax, dword ptr fs:[00000030h] 17_2_0192070D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0192070D mov eax, dword ptr fs:[00000030h] 17_2_0192070D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01854F2E mov eax, dword ptr fs:[00000030h] 17_2_01854F2E
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01854F2E mov eax, dword ptr fs:[00000030h] 17_2_01854F2E
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188E730 mov eax, dword ptr fs:[00000030h] 17_2_0188E730
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186EF40 mov eax, dword ptr fs:[00000030h] 17_2_0186EF40
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186FF60 mov eax, dword ptr fs:[00000030h] 17_2_0186FF60
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01928F6A mov eax, dword ptr fs:[00000030h] 17_2_01928F6A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018EFE87 mov eax, dword ptr fs:[00000030h] 17_2_018EFE87
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018D46A7 mov eax, dword ptr fs:[00000030h] 17_2_018D46A7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01920EA5 mov eax, dword ptr fs:[00000030h] 17_2_01920EA5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01920EA5 mov eax, dword ptr fs:[00000030h] 17_2_01920EA5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01920EA5 mov eax, dword ptr fs:[00000030h] 17_2_01920EA5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01928ED6 mov eax, dword ptr fs:[00000030h] 17_2_01928ED6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018836CC mov eax, dword ptr fs:[00000030h] 17_2_018836CC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01898EC7 mov eax, dword ptr fs:[00000030h] 17_2_01898EC7
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0190FEC0 mov eax, dword ptr fs:[00000030h] 17_2_0190FEC0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018676E2 mov eax, dword ptr fs:[00000030h] 17_2_018676E2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018816E0 mov ecx, dword ptr fs:[00000030h] 17_2_018816E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185C600 mov eax, dword ptr fs:[00000030h] 17_2_0185C600
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185C600 mov eax, dword ptr fs:[00000030h] 17_2_0185C600
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185C600 mov eax, dword ptr fs:[00000030h] 17_2_0185C600
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01888E00 mov eax, dword ptr fs:[00000030h] 17_2_01888E00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188A61C mov eax, dword ptr fs:[00000030h] 17_2_0188A61C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0188A61C mov eax, dword ptr fs:[00000030h] 17_2_0188A61C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01911608 mov eax, dword ptr fs:[00000030h] 17_2_01911608
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0185E620 mov eax, dword ptr fs:[00000030h] 17_2_0185E620
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0190FE3F mov eax, dword ptr fs:[00000030h] 17_2_0190FE3F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01867E41 mov eax, dword ptr fs:[00000030h] 17_2_01867E41
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01867E41 mov eax, dword ptr fs:[00000030h] 17_2_01867E41
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01867E41 mov eax, dword ptr fs:[00000030h] 17_2_01867E41
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01867E41 mov eax, dword ptr fs:[00000030h] 17_2_01867E41
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01867E41 mov eax, dword ptr fs:[00000030h] 17_2_01867E41
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_01867E41 mov eax, dword ptr fs:[00000030h] 17_2_01867E41
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191AE44 mov eax, dword ptr fs:[00000030h] 17_2_0191AE44
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0191AE44 mov eax, dword ptr fs:[00000030h] 17_2_0191AE44
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0186766D mov eax, dword ptr fs:[00000030h] 17_2_0186766D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187AE73 mov eax, dword ptr fs:[00000030h] 17_2_0187AE73
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187AE73 mov eax, dword ptr fs:[00000030h] 17_2_0187AE73
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187AE73 mov eax, dword ptr fs:[00000030h] 17_2_0187AE73
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187AE73 mov eax, dword ptr fs:[00000030h] 17_2_0187AE73
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_0187AE73 mov eax, dword ptr fs:[00000030h] 17_2_0187AE73
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Code function: 17_2_018999A0 NtCreateSection,LdrInitializeThunk, 17_2_018999A0
Source: C:\Users\user\Desktop\Order 20233.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 213.239.221.71 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.ahmedo.ch
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: 1310000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Order 20233.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe base: 11DF008 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Order 20233.exe Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Thread register set: target process: 3452 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Thread register set: target process: 3452 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Thread register set: target process: 3452 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe Jump to behavior
Source: explorer.exe, 00000014.00000000.312817573.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.380769672.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.353276802.0000000001980000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program ManagerT7<=ge
Source: explorer.exe, 00000014.00000000.312817573.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.323500035.0000000006770000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.369946324.00000000090D8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000014.00000000.312817573.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.380769672.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.353276802.0000000001980000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000014.00000000.380301258.0000000001378000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.311808218.0000000001378000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CProgmanile
Source: explorer.exe, 00000014.00000000.312817573.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.380769672.0000000001980000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.353276802.0000000001980000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Order 20233.exe Queries volume information: C:\Users\user\Desktop\Order 20233.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Order 20233.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.429045725.00000000017F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\mstsc.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000015.00000002.531522475.00000000037F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.428209911.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.524509054.0000000000BB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.374923978.000000001033E000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.528604995.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.429045725.00000000017F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 780222 Sample: Order 20233.exe Startdate: 08/01/2023 Architecture: WINDOWS Score: 100 31 www.iamme-label.com 2->31 33 iamme-label.com 2->33 37 Snort IDS alert for network traffic 2->37 39 Multi AV Scanner detection for domain / URL 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 9 other signatures 2->43 9 Order 20233.exe 3 2->9         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\Order 20233.exe.log, CSV 9->29 dropped 47 Writes to foreign memory regions 9->47 49 Injects a PE file into a foreign processes 9->49 13 AddInProcess32.exe 9->13         started        16 aspnet_compiler.exe 9->16         started        18 AddInProcess.exe 9->18         started        20 7 other processes 9->20 signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 13->59 61 Maps a DLL or memory area into another process 13->61 63 Sample uses process hollowing technique 13->63 65 Queues an APC in another process (thread injection) 13->65 22 explorer.exe 13->22 injected process9 dnsIp10 35 www.ahmedo.ch 213.239.221.71, 49698, 80 HETZNER-ASDE Germany 22->35 45 System process connects to network (likely due to code injection or exploit) 22->45 26 mstsc.exe 13 22->26         started        signatures11 process12 signatures13 51 Tries to steal Mail credentials (via file / registry access) 26->51 53 Tries to harvest and steal browser information (history, passwords, etc) 26->53 55 Modifies the context of a thread in another process (thread injection) 26->55 57 Maps a DLL or memory area into another process 26->57
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
213.239.221.71
 www.ahmedo.ch Germany
24940 HETZNER-ASDE true

Contacted Domains

Name IP Active
www.ahmedo.ch 213.239.221.71 true
iamme-label.com 81.169.145.80 true
www.iamme-label.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.ahmedo.ch/dcn0/ true
  • 10%, Virustotal, Browse
  • Avira URL Cloud: malware
 low
http://www.ahmedo.ch/dcn0/?pFQ0Q=4h6DHJsXwPiPeVap&oRk4IZo0=C4IpA5iiNFvhwRpGGB75QVE24l/FHjdcJi1XKvHDvYafZRhhpOblpVmnT5Y5r50LceSQqf3teF0eh20kxL606x8yuiPd0JQ74w== true
  • Avira URL Cloud: malware
 unknown