Windows Analysis Report
rocroc.exe

Overview

General Information

Sample Name: rocroc.exe
Analysis ID: 830303
MD5: b7e5425d0daea66fc85e360a0b0d760d
SHA1: 505084085e1ae2666b7b6d15ea82e4d249cbf85c
SHA256: 06fbb80f37ae3534d8d87fe5444da0a09f10e45b8f2882c9e9fe89e879d380c7
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: rocroc.exe ReversingLabs: Detection: 74%
Yara detected FormBook
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.barnstorm-music.com/re29/www.1whxgd.top Avira URL Cloud: Label: malware
Source: http://www.hagfiw.xyz/re29/www.langlalang.com Avira URL Cloud: Label: malware
Source: http://www.acorsgroup.com Avira URL Cloud: Label: malware
Source: http://www.corollacompany.africa Avira URL Cloud: Label: malware
Source: http://www.senriki.net/re29/?0DK4Qn=yRhazfKsHirG6nKYYI6mAz5vTQUNqz4sZ9ZrGGOS+9vLvJ0EFUwbGotar2I3eQhiIGPXkjmVOg==&nPW=WdYdbB1p3b2H7x Avira URL Cloud: Label: malware
Source: http://www.hagfiw.xyz Avira URL Cloud: Label: malware
Source: http://www.barnstorm-music.com Avira URL Cloud: Label: malware
Source: http://www.barnstorm-music.com/re29/ Avira URL Cloud: Label: malware
Source: http://www.acorsgroup.com/re29/ Avira URL Cloud: Label: malware
Source: http://www.detoxshopbr.store/re29/ Avira URL Cloud: Label: malware
Source: http://www.hagfiw.xyz/re29/ Avira URL Cloud: Label: malware
Source: http://www.detoxshopbr.store/re29/www.jabberglotty.com Avira URL Cloud: Label: malware
Source: http://www.1whxgd.top/re29/ Avira URL Cloud: Label: malware
Source: http://www.senriki.net/re29/www.alaaeldinsoft.com Avira URL Cloud: Label: malware
Source: http://www.1whxgd.top/re29/www.hagfiw.xyz Avira URL Cloud: Label: malware
Source: http://www.corollacompany.africa/re29/www.detoxshopbr.store Avira URL Cloud: Label: malware
Source: http://www.corollacompany.africa/re29/ Avira URL Cloud: Label: malware
Source: http://www.acorsgroup.com/re29/www.fxtcb8.site Avira URL Cloud: Label: malware
Source: www.senriki.net/re29/ Avira URL Cloud: Label: malware
Source: http://www.senriki.net/re29/ Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Avira: detection malicious, Label: HEUR/AGEN.1242497
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe ReversingLabs: Detection: 30%
Machine Learning detection for sample
Source: rocroc.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.nmtargerx.exe.1330000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.nmtargerx.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.senriki.net/re29/"], "decoy": ["barnstorm-music.com", "gazzettadellapuglia.com", "baratieistore.space", "cdrjdkj.com", "carlissablog.com", "langlalang.com", "2886365.com", "aq993.cyou", "jwjwjwjw.com", "car-deals-80304.com", "dikevolesas.info", "buycialistablets.online", "theplantgranny.net", "detoxshopbr.store", "imans.biz", "fightingcock.co.uk", "loveforfurbabies.com", "eastcoastbeveragegroup.com", "alaaeldinsoft.com", "microshel.com", "deal-markt.com", "hypothetical.systems", "baxhakutrade.com", "chiehhsikaoportfolio.com", "brandsmania.net", "follred.com", "6566x14.app", "defi88.com", "h-skyseo.com", "imagina-onshop.com", "bambooleavescompany.com", "cmojohnny.com", "1whxgd.top", "infernaljournal.app", "kk156.net", "chokolatk.com", "guoshan-0800777216.com", "funparty.rsvp", "helenfallon.com", "digitalmagazine.online", "idealcutandtrim.com", "bricoitalia.net", "ecwid-store-copy.net", "iljamusic.com", "uvcon.africa", "hoodiesupplycol.com", "iilykt.top", "continuousvoltage.com", "josephajaogo.africa", "baba-robot.ru", "1wsfcg.top", "hagfiw.xyz", "firstcitizncb.com", "calamitouscrochet.shop", "829727.com", "eleonorasdaycare.com", "lafourmiprovencal.ch", "corollacompany.africa", "acorsgroup.com", "jabberglotty.com", "akhlit.com", "kompetenceboersen.online", "fxtcb8.site", "whetegeneralprojects.africa"]}
Uses 32bit PE files
Source: rocroc.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: rocroc.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: cscript.pdbUGP source: nmtargerx.exe, 00000002.00000002.297730521.00000000015C0000.00000040.10000000.00040000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.297823267.00000000015FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: nmtargerx.exe, 00000001.00000003.249586230.000000001AE70000.00000004.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000001.00000003.249275139.000000001ACE0000.00000004.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000003.257125383.0000000001896000.00000004.00000020.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001A30000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001B4F000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000003.255387906.00000000016F3000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.297668380.000000000459B000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000049EF000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.300560128.0000000004731000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: nmtargerx.exe, nmtargerx.exe, 00000002.00000003.257125383.0000000001896000.00000004.00000020.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001A30000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001B4F000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000003.255387906.00000000016F3000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.297668380.000000000459B000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000049EF000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.300560128.0000000004731000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cscript.pdb source: nmtargerx.exe, 00000002.00000002.297730521.00000000015C0000.00000040.10000000.00040000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.297823267.00000000015FA000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405D74
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_0040699E FindFirstFileW,FindClose, 0_2_0040699E
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_0040290B FindFirstFileW, 0_2_0040290B
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 4x nop then pop esi 2_2_004172FC
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 4x nop then pop edi 2_2_0040E46A

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 160.121.108.17 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.alaaeldinsoft.com
Source: C:\Windows\explorer.exe Domain query: www.kk156.net
Source: C:\Windows\explorer.exe Domain query: www.senriki.net
Source: C:\Windows\explorer.exe Network Connect: 192.185.52.247 80 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49707 -> 192.185.52.247:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49707 -> 192.185.52.247:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49707 -> 192.185.52.247:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.senriki.net/re29/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLAYERLIMITED-AS-APClayerLimitedHK CLAYERLIMITED-AS-APClayerLimitedHK
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /re29/?0DK4Qn=GULsnGSHMoQzF5BSBaA7IgErJIrC6IG18OGrAG0wV2/PJUf48ccOVKgRcy3msHjKmovQQ592kQ==&nPW=WdYdbB1p3b2H7x HTTP/1.1Host: www.kk156.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /re29/?0DK4Qn=yRhazfKsHirG6nKYYI6mAz5vTQUNqz4sZ9ZrGGOS+9vLvJ0EFUwbGotar2I3eQhiIGPXkjmVOg==&nPW=WdYdbB1p3b2H7x HTTP/1.1Host: www.senriki.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 07:48:57 GMTContent-Type: text/htmlContent-Length: 566Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: rocroc.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.1whxgd.top
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.1whxgd.top/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.1whxgd.top/re29/www.hagfiw.xyz
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.1whxgd.topReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acorsgroup.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acorsgroup.com/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acorsgroup.com/re29/www.fxtcb8.site
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.acorsgroup.comReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.alaaeldinsoft.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.alaaeldinsoft.com/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.alaaeldinsoft.com/re29/www.aq993.cyou
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.alaaeldinsoft.comReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aq993.cyou
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aq993.cyou/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aq993.cyou/re29/www.barnstorm-music.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aq993.cyouReferer:
Source: explorer.exe, 00000003.00000000.270169832.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.262086599.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.511875749.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462968225.0000000008442000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.520408845.0000000008442000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.barnstorm-music.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.barnstorm-music.com/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.barnstorm-music.com/re29/www.1whxgd.top
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.barnstorm-music.comReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.corollacompany.africa
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.corollacompany.africa/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.corollacompany.africa/re29/www.detoxshopbr.store
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.corollacompany.africaReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.defi88.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.defi88.com/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.defi88.com/re29/www.corollacompany.africa
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.defi88.comReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.detoxshopbr.store
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.detoxshopbr.store/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.detoxshopbr.store/re29/www.jabberglotty.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.detoxshopbr.storeReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dikevolesas.info
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dikevolesas.info/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dikevolesas.info/re29/www.follred.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dikevolesas.infoReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.follred.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.follred.com/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.follred.com/re29/R
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.follred.comReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fxtcb8.site
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fxtcb8.site/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fxtcb8.site/re29/www.dikevolesas.info
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fxtcb8.siteReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.hagfiw.xyz
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.hagfiw.xyz/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.hagfiw.xyz/re29/www.langlalang.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.hagfiw.xyzReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jabberglotty.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jabberglotty.com/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jabberglotty.com/re29/www.acorsgroup.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jabberglotty.comReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kk156.net
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kk156.net/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kk156.net/re29/www.senriki.net
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.kk156.netReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.langlalang.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.langlalang.com/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.langlalang.com/re29/www.defi88.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.langlalang.comReferer:
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.senriki.net
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.senriki.net/re29/
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.senriki.net/re29/www.alaaeldinsoft.com
Source: explorer.exe, 00000003.00000002.524465285.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.461212385.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462613362.000000000F4B5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.senriki.netReferer:
Source: explorer.exe, 00000003.00000002.525150078.0000000013A0F000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000008.00000002.513850777.00000000052EF000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://47.116.3.86:29920/kok/logo.png
Source: explorer.exe, 00000003.00000002.525150078.0000000013A0F000.00000004.80000000.00040000.00000000.sdmp, cscript.exe, 00000008.00000002.513850777.00000000052EF000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://www.zoty1116.com:30120/register/?i_code=4627044
Source: unknown DNS traffic detected: queries for: www.kk156.net
Source: global traffic HTTP traffic detected: GET /re29/?0DK4Qn=GULsnGSHMoQzF5BSBaA7IgErJIrC6IG18OGrAG0wV2/PJUf48ccOVKgRcy3msHjKmovQQ592kQ==&nPW=WdYdbB1p3b2H7x HTTP/1.1Host: www.kk156.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /re29/?0DK4Qn=yRhazfKsHirG6nKYYI6mAz5vTQUNqz4sZ9ZrGGOS+9vLvJ0EFUwbGotar2I3eQhiIGPXkjmVOg==&nPW=WdYdbB1p3b2H7x HTTP/1.1Host: www.senriki.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Creates a DirectInput object (often for capturing keystrokes)
Source: nmtargerx.exe, 00000001.00000002.257134167.00000000014EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405809

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.516554082.0000000005840000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: nmtargerx.exe PID: 3140, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: cscript.exe PID: 1788, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Uses 32bit PE files
Source: rocroc.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.516554082.0000000005840000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: nmtargerx.exe PID: 3140, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: cscript.exe PID: 1788, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403640
Detected potential crypto function
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00406D5F 0_2_00406D5F
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B2495 1_2_000B2495
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F53237 1_2_02F53237
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F533B4 1_2_02F533B4
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_000B2495 2_2_000B2495
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041E85B 2_2_0041E85B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041D81B 2_2_0041D81B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041E086 2_2_0041E086
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041DAD2 2_2_0041DAD2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041E28B 2_2_0041E28B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041E5F1 2_2_0041E5F1
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041DD91 2_2_0041DD91
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_00409E4B 2_2_00409E4B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_00409E50 2_2_00409E50
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A74120 2_2_01A74120
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5F900 2_2_01A5F900
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A820A0 2_2_01A820A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B220A8 2_2_01B220A8
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6B090 2_2_01A6B090
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B228EC 2_2_01B228EC
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11002 2_2_01B11002
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8EBB0 2_2_01A8EBB0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1DBD2 2_2_01B1DBD2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B22B28 2_2_01B22B28
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B222AE 2_2_01B222AE
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82581 2_2_01A82581
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6D5E0 2_2_01A6D5E0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B225DD 2_2_01B225DD
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A50D20 2_2_01A50D20
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B22D07 2_2_01B22D07
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B21D55 2_2_01B21D55
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6841F 2_2_01A6841F
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1D466 2_2_01B1D466
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B21FF1 2_2_01B21FF1
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: String function: 000B2A5C appears 70 times
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: String function: 000B1E8A appears 44 times
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: String function: 01A5B150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A350 NtCreateFile, 2_2_0041A350
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A400 NtReadFile, 2_2_0041A400
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A480 NtClose, 2_2_0041A480
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A530 NtAllocateVirtualMemory, 2_2_0041A530
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A34A NtCreateFile, 2_2_0041A34A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A3A3 NtReadFile, 2_2_0041A3A3
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A52A NtAllocateVirtualMemory, 2_2_0041A52A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A999A0 NtCreateSection,LdrInitializeThunk, 2_2_01A999A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99910 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_01A99910
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A998F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_01A998F0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99860 NtQuerySystemInformation,LdrInitializeThunk, 2_2_01A99860
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99840 NtDelayExecution,LdrInitializeThunk, 2_2_01A99840
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99A20 NtResumeThread,LdrInitializeThunk, 2_2_01A99A20
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99A00 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_01A99A00
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99A50 NtCreateFile,LdrInitializeThunk, 2_2_01A99A50
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A995D0 NtClose,LdrInitializeThunk, 2_2_01A995D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99540 NtReadFile,LdrInitializeThunk, 2_2_01A99540
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A997A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_01A997A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99780 NtMapViewOfSection,LdrInitializeThunk, 2_2_01A99780
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99710 NtQueryInformationToken,LdrInitializeThunk, 2_2_01A99710
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A996E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_01A996E0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99660 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_01A99660
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A999D0 NtCreateProcessEx, 2_2_01A999D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99950 NtQueueApcThread, 2_2_01A99950
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A998A0 NtWriteVirtualMemory, 2_2_01A998A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99820 NtEnumerateKey, 2_2_01A99820
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A9B040 NtSuspendThread, 2_2_01A9B040
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A9A3B0 NtGetContextThread, 2_2_01A9A3B0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99B00 NtSetValueKey, 2_2_01A99B00
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99A80 NtOpenDirectoryObject, 2_2_01A99A80
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99A10 NtQuerySection, 2_2_01A99A10
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A995F0 NtQueryInformationFile, 2_2_01A995F0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99520 NtWaitForSingleObject, 2_2_01A99520
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A9AD30 NtSetContextThread, 2_2_01A9AD30
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99560 NtWriteFile, 2_2_01A99560
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99FE0 NtCreateMutant, 2_2_01A99FE0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99730 NtQueryVirtualMemory, 2_2_01A99730
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A9A710 NtOpenProcessToken, 2_2_01A9A710
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99760 NtOpenProcess, 2_2_01A99760
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A9A770 NtOpenThread, 2_2_01A9A770
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A99770 NtSetInformationFile, 2_2_01A99770
Source: rocroc.exe ReversingLabs: Detection: 74%
Source: C:\Users\user\Desktop\rocroc.exe File read: C:\Users\user\Desktop\rocroc.exe Jump to behavior
Source: rocroc.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\rocroc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\rocroc.exe C:\Users\user\Desktop\rocroc.exe
Source: C:\Users\user\Desktop\rocroc.exe Process created: C:\Users\user\AppData\Local\Temp\nmtargerx.exe "C:\Users\user\AppData\Local\Temp\nmtargerx.exe" C:\Users\user\AppData\Local\Temp\rimgurbkmm.edy
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Process created: C:\Users\user\AppData\Local\Temp\nmtargerx.exe C:\Users\user\AppData\Local\Temp\nmtargerx.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\nmtargerx.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rocroc.exe Process created: C:\Users\user\AppData\Local\Temp\nmtargerx.exe "C:\Users\user\AppData\Local\Temp\nmtargerx.exe" C:\Users\user\AppData\Local\Temp\rimgurbkmm.edy Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Process created: C:\Users\user\AppData\Local\Temp\nmtargerx.exe C:\Users\user\AppData\Local\Temp\nmtargerx.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\nmtargerx.exe" Jump to behavior
Source: C:\Users\user\Desktop\rocroc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403640
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\WER\ERC\statecache.lock Jump to behavior
Source: C:\Users\user\Desktop\rocroc.exe File created: C:\Users\user\AppData\Local\Temp\nsoFB76.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@10/5@4/2
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_004021AA CoCreateInstance, 0_2_004021AA
Source: C:\Users\user\Desktop\rocroc.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404AB5
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2604:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Command line argument: 248058040134 1_2_000B1210
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Command line argument: 248058040134 2_2_000B1210
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: rocroc.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: cscript.pdbUGP source: nmtargerx.exe, 00000002.00000002.297730521.00000000015C0000.00000040.10000000.00040000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.297823267.00000000015FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: nmtargerx.exe, 00000001.00000003.249586230.000000001AE70000.00000004.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000001.00000003.249275139.000000001ACE0000.00000004.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000003.257125383.0000000001896000.00000004.00000020.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001A30000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001B4F000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000003.255387906.00000000016F3000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.297668380.000000000459B000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000049EF000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.300560128.0000000004731000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: nmtargerx.exe, nmtargerx.exe, 00000002.00000003.257125383.0000000001896000.00000004.00000020.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001A30000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.298053237.0000000001B4F000.00000040.00001000.00020000.00000000.sdmp, nmtargerx.exe, 00000002.00000003.255387906.00000000016F3000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.297668380.000000000459B000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000049EF000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000002.512723204.00000000048D0000.00000040.00001000.00020000.00000000.sdmp, cscript.exe, 00000008.00000003.300560128.0000000004731000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cscript.pdb source: nmtargerx.exe, 00000002.00000002.297730521.00000000015C0000.00000040.10000000.00040000.00000000.sdmp, nmtargerx.exe, 00000002.00000002.297823267.00000000015FA000.00000004.00000020.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B2AA1 push ecx; ret 1_2_000B2AB4
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F53FA7 push ebp; retf 1_2_02F53FBB
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_000B2AA1 push ecx; ret 2_2_000B2AB4
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041A905 push edi; retf 2_2_0041A90F
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041D4F2 push eax; ret 2_2_0041D4F8
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041D4FB push eax; ret 2_2_0041D562
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041D4A5 push eax; ret 2_2_0041D4F8
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0041D55C push eax; ret 2_2_0041D562
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_004165C9 push eax; ret 2_2_004165CA
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AAD0D1 push ecx; ret 2_2_01AAD0E4
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B6096 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 1_2_000B6096
Drops PE files
Source: C:\Users\user\Desktop\rocroc.exe File created: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xE1
Source: C:\Users\user\Desktop\rocroc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000000839904 second address: 000000000083990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000000839B6E second address: 0000000000839B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\cscript.exe TID: 2188 Thread sleep time: -42000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cscript.exe Last function: Thread delayed
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_00409AA0 rdtsc 2_2_00409AA0
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 872 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 854 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe API coverage: 5.2 %
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F5315A GetSystemInfo, 1_2_02F5315A
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405D74
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_0040699E FindFirstFileW,FindClose, 0_2_0040699E
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_0040290B FindFirstFileW, 0_2_0040290B
Source: C:\Users\user\Desktop\rocroc.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000003.00000003.463518023.000000000F6DF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000003.463518023.000000000F6DF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000003.461063437.000000000683A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000002.519896009.00000000081DD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000^
Source: explorer.exe, 00000003.00000002.516863587.0000000006710000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: explorer.exe, 00000003.00000003.462352691.000000000F52A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.524564175.000000000F54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.462767000.000000000F53F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllte
Source: explorer.exe, 00000003.00000003.463518023.000000000F6DF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5
Source: explorer.exe, 00000003.00000002.524659417.000000000F5F1000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000003.00000000.270169832.0000000008304000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000003.00000003.463518023.000000000F6DF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: explorer.exe, 00000003.00000003.462516348.000000000F255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.463546500.000000000F2A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW4t$"
Source: explorer.exe, 00000003.00000000.270169832.00000000082B2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S
Source: explorer.exe, 00000003.00000003.463621804.00000000082B2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000003.00000003.463621804.0000000008250000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>&
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B3819 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_000B3819
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B6096 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer, 1_2_000B6096
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B984C CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, 1_2_000B984C
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_00409AA0 rdtsc 2_2_00409AA0
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F52AFB mov eax, dword ptr fs:[00000030h] 1_2_02F52AFB
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F52ABE mov eax, dword ptr fs:[00000030h] 1_2_02F52ABE
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F52A89 mov eax, dword ptr fs:[00000030h] 1_2_02F52A89
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_02F529DF mov eax, dword ptr fs:[00000030h] 1_2_02F529DF
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A861A0 mov eax, dword ptr fs:[00000030h] 2_2_01A861A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A861A0 mov eax, dword ptr fs:[00000030h] 2_2_01A861A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD69A6 mov eax, dword ptr fs:[00000030h] 2_2_01AD69A6
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD51BE mov eax, dword ptr fs:[00000030h] 2_2_01AD51BE
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD51BE mov eax, dword ptr fs:[00000030h] 2_2_01AD51BE
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD51BE mov eax, dword ptr fs:[00000030h] 2_2_01AD51BE
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD51BE mov eax, dword ptr fs:[00000030h] 2_2_01AD51BE
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7C182 mov eax, dword ptr fs:[00000030h] 2_2_01A7C182
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8A185 mov eax, dword ptr fs:[00000030h] 2_2_01A8A185
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82990 mov eax, dword ptr fs:[00000030h] 2_2_01A82990
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5B1E1 mov eax, dword ptr fs:[00000030h] 2_2_01A5B1E1
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5B1E1 mov eax, dword ptr fs:[00000030h] 2_2_01A5B1E1
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5B1E1 mov eax, dword ptr fs:[00000030h] 2_2_01A5B1E1
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AE41E8 mov eax, dword ptr fs:[00000030h] 2_2_01AE41E8
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A74120 mov eax, dword ptr fs:[00000030h] 2_2_01A74120
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A74120 mov eax, dword ptr fs:[00000030h] 2_2_01A74120
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A74120 mov eax, dword ptr fs:[00000030h] 2_2_01A74120
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A74120 mov eax, dword ptr fs:[00000030h] 2_2_01A74120
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A74120 mov ecx, dword ptr fs:[00000030h] 2_2_01A74120
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8513A mov eax, dword ptr fs:[00000030h] 2_2_01A8513A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8513A mov eax, dword ptr fs:[00000030h] 2_2_01A8513A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59100 mov eax, dword ptr fs:[00000030h] 2_2_01A59100
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59100 mov eax, dword ptr fs:[00000030h] 2_2_01A59100
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59100 mov eax, dword ptr fs:[00000030h] 2_2_01A59100
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5C962 mov eax, dword ptr fs:[00000030h] 2_2_01A5C962
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5B171 mov eax, dword ptr fs:[00000030h] 2_2_01A5B171
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5B171 mov eax, dword ptr fs:[00000030h] 2_2_01A5B171
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7B944 mov eax, dword ptr fs:[00000030h] 2_2_01A7B944
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7B944 mov eax, dword ptr fs:[00000030h] 2_2_01A7B944
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A990AF mov eax, dword ptr fs:[00000030h] 2_2_01A990AF
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A820A0 mov eax, dword ptr fs:[00000030h] 2_2_01A820A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A820A0 mov eax, dword ptr fs:[00000030h] 2_2_01A820A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A820A0 mov eax, dword ptr fs:[00000030h] 2_2_01A820A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A820A0 mov eax, dword ptr fs:[00000030h] 2_2_01A820A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A820A0 mov eax, dword ptr fs:[00000030h] 2_2_01A820A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A820A0 mov eax, dword ptr fs:[00000030h] 2_2_01A820A0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8F0BF mov ecx, dword ptr fs:[00000030h] 2_2_01A8F0BF
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8F0BF mov eax, dword ptr fs:[00000030h] 2_2_01A8F0BF
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8F0BF mov eax, dword ptr fs:[00000030h] 2_2_01A8F0BF
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59080 mov eax, dword ptr fs:[00000030h] 2_2_01A59080
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD3884 mov eax, dword ptr fs:[00000030h] 2_2_01AD3884
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD3884 mov eax, dword ptr fs:[00000030h] 2_2_01AD3884
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A558EC mov eax, dword ptr fs:[00000030h] 2_2_01A558EC
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEB8D0 mov eax, dword ptr fs:[00000030h] 2_2_01AEB8D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEB8D0 mov ecx, dword ptr fs:[00000030h] 2_2_01AEB8D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEB8D0 mov eax, dword ptr fs:[00000030h] 2_2_01AEB8D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEB8D0 mov eax, dword ptr fs:[00000030h] 2_2_01AEB8D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEB8D0 mov eax, dword ptr fs:[00000030h] 2_2_01AEB8D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEB8D0 mov eax, dword ptr fs:[00000030h] 2_2_01AEB8D0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8002D mov eax, dword ptr fs:[00000030h] 2_2_01A8002D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8002D mov eax, dword ptr fs:[00000030h] 2_2_01A8002D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8002D mov eax, dword ptr fs:[00000030h] 2_2_01A8002D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8002D mov eax, dword ptr fs:[00000030h] 2_2_01A8002D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8002D mov eax, dword ptr fs:[00000030h] 2_2_01A8002D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6B02A mov eax, dword ptr fs:[00000030h] 2_2_01A6B02A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6B02A mov eax, dword ptr fs:[00000030h] 2_2_01A6B02A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6B02A mov eax, dword ptr fs:[00000030h] 2_2_01A6B02A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6B02A mov eax, dword ptr fs:[00000030h] 2_2_01A6B02A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B24015 mov eax, dword ptr fs:[00000030h] 2_2_01B24015
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B24015 mov eax, dword ptr fs:[00000030h] 2_2_01B24015
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD7016 mov eax, dword ptr fs:[00000030h] 2_2_01AD7016
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD7016 mov eax, dword ptr fs:[00000030h] 2_2_01AD7016
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD7016 mov eax, dword ptr fs:[00000030h] 2_2_01AD7016
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B12073 mov eax, dword ptr fs:[00000030h] 2_2_01B12073
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B21074 mov eax, dword ptr fs:[00000030h] 2_2_01B21074
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A70050 mov eax, dword ptr fs:[00000030h] 2_2_01A70050
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A70050 mov eax, dword ptr fs:[00000030h] 2_2_01A70050
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A84BAD mov eax, dword ptr fs:[00000030h] 2_2_01A84BAD
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A84BAD mov eax, dword ptr fs:[00000030h] 2_2_01A84BAD
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A84BAD mov eax, dword ptr fs:[00000030h] 2_2_01A84BAD
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B25BA5 mov eax, dword ptr fs:[00000030h] 2_2_01B25BA5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A61B8F mov eax, dword ptr fs:[00000030h] 2_2_01A61B8F
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A61B8F mov eax, dword ptr fs:[00000030h] 2_2_01A61B8F
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B0D380 mov ecx, dword ptr fs:[00000030h] 2_2_01B0D380
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8B390 mov eax, dword ptr fs:[00000030h] 2_2_01A8B390
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1138A mov eax, dword ptr fs:[00000030h] 2_2_01B1138A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82397 mov eax, dword ptr fs:[00000030h] 2_2_01A82397
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A803E2 mov eax, dword ptr fs:[00000030h] 2_2_01A803E2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A803E2 mov eax, dword ptr fs:[00000030h] 2_2_01A803E2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A803E2 mov eax, dword ptr fs:[00000030h] 2_2_01A803E2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A803E2 mov eax, dword ptr fs:[00000030h] 2_2_01A803E2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A803E2 mov eax, dword ptr fs:[00000030h] 2_2_01A803E2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A803E2 mov eax, dword ptr fs:[00000030h] 2_2_01A803E2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7DBE9 mov eax, dword ptr fs:[00000030h] 2_2_01A7DBE9
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD53CA mov eax, dword ptr fs:[00000030h] 2_2_01AD53CA
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD53CA mov eax, dword ptr fs:[00000030h] 2_2_01AD53CA
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1131B mov eax, dword ptr fs:[00000030h] 2_2_01B1131B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5DB60 mov ecx, dword ptr fs:[00000030h] 2_2_01A5DB60
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A83B7A mov eax, dword ptr fs:[00000030h] 2_2_01A83B7A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A83B7A mov eax, dword ptr fs:[00000030h] 2_2_01A83B7A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5DB40 mov eax, dword ptr fs:[00000030h] 2_2_01A5DB40
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B28B58 mov eax, dword ptr fs:[00000030h] 2_2_01B28B58
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5F358 mov eax, dword ptr fs:[00000030h] 2_2_01A5F358
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A552A5 mov eax, dword ptr fs:[00000030h] 2_2_01A552A5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A552A5 mov eax, dword ptr fs:[00000030h] 2_2_01A552A5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A552A5 mov eax, dword ptr fs:[00000030h] 2_2_01A552A5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A552A5 mov eax, dword ptr fs:[00000030h] 2_2_01A552A5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A552A5 mov eax, dword ptr fs:[00000030h] 2_2_01A552A5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6AAB0 mov eax, dword ptr fs:[00000030h] 2_2_01A6AAB0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6AAB0 mov eax, dword ptr fs:[00000030h] 2_2_01A6AAB0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8FAB0 mov eax, dword ptr fs:[00000030h] 2_2_01A8FAB0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8D294 mov eax, dword ptr fs:[00000030h] 2_2_01A8D294
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8D294 mov eax, dword ptr fs:[00000030h] 2_2_01A8D294
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82AE4 mov eax, dword ptr fs:[00000030h] 2_2_01A82AE4
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82ACB mov eax, dword ptr fs:[00000030h] 2_2_01A82ACB
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A94A2C mov eax, dword ptr fs:[00000030h] 2_2_01A94A2C
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A94A2C mov eax, dword ptr fs:[00000030h] 2_2_01A94A2C
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1AA16 mov eax, dword ptr fs:[00000030h] 2_2_01B1AA16
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1AA16 mov eax, dword ptr fs:[00000030h] 2_2_01B1AA16
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A68A0A mov eax, dword ptr fs:[00000030h] 2_2_01A68A0A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5AA16 mov eax, dword ptr fs:[00000030h] 2_2_01A5AA16
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5AA16 mov eax, dword ptr fs:[00000030h] 2_2_01A5AA16
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A55210 mov eax, dword ptr fs:[00000030h] 2_2_01A55210
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A55210 mov ecx, dword ptr fs:[00000030h] 2_2_01A55210
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A55210 mov eax, dword ptr fs:[00000030h] 2_2_01A55210
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A55210 mov eax, dword ptr fs:[00000030h] 2_2_01A55210
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A73A1C mov eax, dword ptr fs:[00000030h] 2_2_01A73A1C
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B0B260 mov eax, dword ptr fs:[00000030h] 2_2_01B0B260
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B0B260 mov eax, dword ptr fs:[00000030h] 2_2_01B0B260
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B28A62 mov eax, dword ptr fs:[00000030h] 2_2_01B28A62
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A9927A mov eax, dword ptr fs:[00000030h] 2_2_01A9927A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1EA55 mov eax, dword ptr fs:[00000030h] 2_2_01B1EA55
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59240 mov eax, dword ptr fs:[00000030h] 2_2_01A59240
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59240 mov eax, dword ptr fs:[00000030h] 2_2_01A59240
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59240 mov eax, dword ptr fs:[00000030h] 2_2_01A59240
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A59240 mov eax, dword ptr fs:[00000030h] 2_2_01A59240
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AE4257 mov eax, dword ptr fs:[00000030h] 2_2_01AE4257
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A835A1 mov eax, dword ptr fs:[00000030h] 2_2_01A835A1
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A81DB5 mov eax, dword ptr fs:[00000030h] 2_2_01A81DB5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A81DB5 mov eax, dword ptr fs:[00000030h] 2_2_01A81DB5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A81DB5 mov eax, dword ptr fs:[00000030h] 2_2_01A81DB5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B205AC mov eax, dword ptr fs:[00000030h] 2_2_01B205AC
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B205AC mov eax, dword ptr fs:[00000030h] 2_2_01B205AC
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82581 mov eax, dword ptr fs:[00000030h] 2_2_01A82581
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82581 mov eax, dword ptr fs:[00000030h] 2_2_01A82581
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82581 mov eax, dword ptr fs:[00000030h] 2_2_01A82581
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A82581 mov eax, dword ptr fs:[00000030h] 2_2_01A82581
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A52D8A mov eax, dword ptr fs:[00000030h] 2_2_01A52D8A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A52D8A mov eax, dword ptr fs:[00000030h] 2_2_01A52D8A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A52D8A mov eax, dword ptr fs:[00000030h] 2_2_01A52D8A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A52D8A mov eax, dword ptr fs:[00000030h] 2_2_01A52D8A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A52D8A mov eax, dword ptr fs:[00000030h] 2_2_01A52D8A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8FD9B mov eax, dword ptr fs:[00000030h] 2_2_01A8FD9B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8FD9B mov eax, dword ptr fs:[00000030h] 2_2_01A8FD9B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B08DF1 mov eax, dword ptr fs:[00000030h] 2_2_01B08DF1
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6D5E0 mov eax, dword ptr fs:[00000030h] 2_2_01A6D5E0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6D5E0 mov eax, dword ptr fs:[00000030h] 2_2_01A6D5E0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1FDE2 mov eax, dword ptr fs:[00000030h] 2_2_01B1FDE2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1FDE2 mov eax, dword ptr fs:[00000030h] 2_2_01B1FDE2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1FDE2 mov eax, dword ptr fs:[00000030h] 2_2_01B1FDE2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1FDE2 mov eax, dword ptr fs:[00000030h] 2_2_01B1FDE2
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6DC9 mov eax, dword ptr fs:[00000030h] 2_2_01AD6DC9
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6DC9 mov eax, dword ptr fs:[00000030h] 2_2_01AD6DC9
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6DC9 mov eax, dword ptr fs:[00000030h] 2_2_01AD6DC9
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6DC9 mov ecx, dword ptr fs:[00000030h] 2_2_01AD6DC9
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6DC9 mov eax, dword ptr fs:[00000030h] 2_2_01AD6DC9
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6DC9 mov eax, dword ptr fs:[00000030h] 2_2_01AD6DC9
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B28D34 mov eax, dword ptr fs:[00000030h] 2_2_01B28D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B1E539 mov eax, dword ptr fs:[00000030h] 2_2_01B1E539
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A63D34 mov eax, dword ptr fs:[00000030h] 2_2_01A63D34
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A84D3B mov eax, dword ptr fs:[00000030h] 2_2_01A84D3B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A84D3B mov eax, dword ptr fs:[00000030h] 2_2_01A84D3B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A84D3B mov eax, dword ptr fs:[00000030h] 2_2_01A84D3B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A5AD30 mov eax, dword ptr fs:[00000030h] 2_2_01A5AD30
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01ADA537 mov eax, dword ptr fs:[00000030h] 2_2_01ADA537
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7C577 mov eax, dword ptr fs:[00000030h] 2_2_01A7C577
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7C577 mov eax, dword ptr fs:[00000030h] 2_2_01A7C577
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A93D43 mov eax, dword ptr fs:[00000030h] 2_2_01A93D43
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD3540 mov eax, dword ptr fs:[00000030h] 2_2_01AD3540
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A77D50 mov eax, dword ptr fs:[00000030h] 2_2_01A77D50
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6849B mov eax, dword ptr fs:[00000030h] 2_2_01A6849B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B114FB mov eax, dword ptr fs:[00000030h] 2_2_01B114FB
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6CF0 mov eax, dword ptr fs:[00000030h] 2_2_01AD6CF0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6CF0 mov eax, dword ptr fs:[00000030h] 2_2_01AD6CF0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6CF0 mov eax, dword ptr fs:[00000030h] 2_2_01AD6CF0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B28CD6 mov eax, dword ptr fs:[00000030h] 2_2_01B28CD6
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8BC2C mov eax, dword ptr fs:[00000030h] 2_2_01A8BC2C
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6C0A mov eax, dword ptr fs:[00000030h] 2_2_01AD6C0A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6C0A mov eax, dword ptr fs:[00000030h] 2_2_01AD6C0A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6C0A mov eax, dword ptr fs:[00000030h] 2_2_01AD6C0A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD6C0A mov eax, dword ptr fs:[00000030h] 2_2_01AD6C0A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B11C06 mov eax, dword ptr fs:[00000030h] 2_2_01B11C06
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B2740D mov eax, dword ptr fs:[00000030h] 2_2_01B2740D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B2740D mov eax, dword ptr fs:[00000030h] 2_2_01B2740D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B2740D mov eax, dword ptr fs:[00000030h] 2_2_01B2740D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7746D mov eax, dword ptr fs:[00000030h] 2_2_01A7746D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8A44B mov eax, dword ptr fs:[00000030h] 2_2_01A8A44B
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEC450 mov eax, dword ptr fs:[00000030h] 2_2_01AEC450
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEC450 mov eax, dword ptr fs:[00000030h] 2_2_01AEC450
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A68794 mov eax, dword ptr fs:[00000030h] 2_2_01A68794
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD7794 mov eax, dword ptr fs:[00000030h] 2_2_01AD7794
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD7794 mov eax, dword ptr fs:[00000030h] 2_2_01AD7794
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AD7794 mov eax, dword ptr fs:[00000030h] 2_2_01AD7794
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A937F5 mov eax, dword ptr fs:[00000030h] 2_2_01A937F5
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A54F2E mov eax, dword ptr fs:[00000030h] 2_2_01A54F2E
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A54F2E mov eax, dword ptr fs:[00000030h] 2_2_01A54F2E
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8E730 mov eax, dword ptr fs:[00000030h] 2_2_01A8E730
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8A70E mov eax, dword ptr fs:[00000030h] 2_2_01A8A70E
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A8A70E mov eax, dword ptr fs:[00000030h] 2_2_01A8A70E
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A7F716 mov eax, dword ptr fs:[00000030h] 2_2_01A7F716
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEFF10 mov eax, dword ptr fs:[00000030h] 2_2_01AEFF10
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01AEFF10 mov eax, dword ptr fs:[00000030h] 2_2_01AEFF10
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B2070D mov eax, dword ptr fs:[00000030h] 2_2_01B2070D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B2070D mov eax, dword ptr fs:[00000030h] 2_2_01B2070D
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6FF60 mov eax, dword ptr fs:[00000030h] 2_2_01A6FF60
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01B28F6A mov eax, dword ptr fs:[00000030h] 2_2_01B28F6A
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_01A6EF40 mov eax, dword ptr fs:[00000030h] 2_2_01A6EF40
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_0040ACE0 LdrLoadDll, 2_2_0040ACE0
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B3819 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_000B3819
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B9622 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_000B9622
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B5B55 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_000B5B55
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B4954 SetUnhandledExceptionFilter, 1_2_000B4954
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_000B3819 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_000B3819
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_000B9622 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_000B9622
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_000B5B55 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_000B5B55
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 2_2_000B4954 SetUnhandledExceptionFilter, 2_2_000B4954

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 160.121.108.17 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.alaaeldinsoft.com
Source: C:\Windows\explorer.exe Domain query: www.kk156.net
Source: C:\Windows\explorer.exe Domain query: www.senriki.net
Source: C:\Windows\explorer.exe Network Connect: 192.185.52.247 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: D90000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\nmtargerx.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Thread register set: target process: 3452 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 3452 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Process created: C:\Users\user\AppData\Local\Temp\nmtargerx.exe C:\Users\user\AppData\Local\Temp\nmtargerx.exe Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\nmtargerx.exe" Jump to behavior
Source: explorer.exe, 00000003.00000000.262735788.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.512768045.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: XProgram Manager
Source: explorer.exe, 00000003.00000000.267064140.0000000005D90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.516781838.0000000005D90000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.262735788.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.262735788.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.262086599.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.511875749.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.262735788.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.512768045.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: GetLocaleInfoA, 1_2_000BADAD
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: GetLocaleInfoA, 2_2_000BADAD
Source: C:\Users\user\AppData\Local\Temp\nmtargerx.exe Code function: 1_2_000B5578 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 1_2_000B5578
Source: C:\Users\user\Desktop\rocroc.exe Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403640

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.nmtargerx.exe.1330000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.nmtargerx.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.512168370.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297641452.0000000001400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.511623036.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297541015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.512093073.0000000000D30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.297615381.00000000013D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.256878457.0000000001330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 830303 Sample: rocroc.exe Startdate: 20/03/2023 Architecture: WINDOWS Score: 100 34 www.aq993.cyou 2->34 50 Snort IDS alert for network traffic 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 Antivirus detection for URL or domain 2->54 56 5 other signatures 2->56 12 rocroc.exe 19 2->12         started        signatures3 process4 file5 32 C:\Users\user\AppData\Local\...\nmtargerx.exe, PE32 12->32 dropped 15 nmtargerx.exe 12->15         started        process6 signatures7 66 Antivirus detection for dropped file 15->66 68 Multi AV Scanner detection for dropped file 15->68 70 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 15->70 72 2 other signatures 15->72 18 nmtargerx.exe 15->18         started        process8 signatures9 42 Modifies the context of a thread in another process (thread injection) 18->42 44 Maps a DLL or memory area into another process 18->44 46 Sample uses process hollowing technique 18->46 48 Queues an APC in another process (thread injection) 18->48 21 explorer.exe 3 6 18->21 injected process10 dnsIp11 36 www.kk156.net 192.185.52.247, 49707, 80 UNIFIEDLAYER-AS-1US United States 21->36 38 www.senriki.net 160.121.108.17, 49708, 80 CLAYERLIMITED-AS-APClayerLimitedHK South Africa 21->38 40 www.alaaeldinsoft.com 21->40 58 System process connects to network (likely due to code injection or exploit) 21->58 25 cscript.exe 21->25         started        signatures12 process13 signatures14 60 Modifies the context of a thread in another process (thread injection) 25->60 62 Maps a DLL or memory area into another process 25->62 64 Tries to detect virtualization through RDTSC time measurements 25->64 28 cmd.exe 1 25->28         started        process15 process16 30 conhost.exe 28->30         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
160.121.108.17
 www.senriki.net South Africa
137951 CLAYERLIMITED-AS-APClayerLimitedHK true
192.185.52.247
 www.kk156.net United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
www.senriki.net 160.121.108.17 true
www.kk156.net 192.185.52.247 true
www.aq993.cyou unknown unknown
www.alaaeldinsoft.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.senriki.net/re29/?0DK4Qn=yRhazfKsHirG6nKYYI6mAz5vTQUNqz4sZ9ZrGGOS+9vLvJ0EFUwbGotar2I3eQhiIGPXkjmVOg==&nPW=WdYdbB1p3b2H7x true
  • Avira URL Cloud: malware
 unknown
http://www.kk156.net/re29/?0DK4Qn=GULsnGSHMoQzF5BSBaA7IgErJIrC6IG18OGrAG0wV2/PJUf48ccOVKgRcy3msHjKmovQQ592kQ==&nPW=WdYdbB1p3b2H7x true
  • Avira URL Cloud: safe
 unknown
www.senriki.net/re29/ true
  • Avira URL Cloud: malware
 low