Edit tour

Windows Analysis Report
OmPnD1qvad.exe

Overview

General Information

Sample Name:	OmPnD1qvad.exe
Original Sample Name:	302b13223db8c63367c43b004b9395d8.exe
Analysis ID:	894060
MD5:	302b13223db8c63367c43b004b9395d8
SHA1:	2fda947fb80d0089f41fef46137b52bab9b9845e
SHA256:	9802c511f650d5eb611d309889655ac2f8daab5f87c30463b2505da99076192b
Tags:	exe
Infos:

Detection

Redline Clipper

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Redline Clipper

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Sigma detected: Schedule system process

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Drops PE files with benign system names

Injects a PE file into a foreign processes

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Drops PE files

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Creates a window with clipboard capturing capabilities

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Classification

Process Tree

System is w10x64

OmPnD1qvad.exe (PID: 6544 cmdline: C:\Users\user\Desktop\OmPnD1qvad.exe MD5: 302B13223DB8C63367C43B004B9395D8)

OmPnD1qvad.exe (PID: 5920 cmdline: C:\Users\user\Desktop\OmPnD1qvad.exe MD5: 302B13223DB8C63367C43B004B9395D8)

cmd.exe (PID: 5876 cmdline: cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6768 cmdline: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6724 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 6864 cmdline: cmd.exe" /C copy "C:\Users\user\Desktop\OmPnD1qvad.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6828 cmdline: C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: 302B13223DB8C63367C43B004B9395D8)

svchost.exe (PID: 6936 cmdline: C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: 302B13223DB8C63367C43B004B9395D8)

cmd.exe (PID: 6932 cmdline: cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7028 cmdline: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5388 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 5408 cmdline: cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 3176 cmdline: C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: 302B13223DB8C63367C43B004B9395D8)

svchost.exe (PID: 6892 cmdline: C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: 302B13223DB8C63367C43B004B9395D8)

cmd.exe (PID: 6908 cmdline: cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6980 cmdline: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 7116 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 7160 cmdline: cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 2376 cmdline: C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: 302B13223DB8C63367C43B004B9395D8)

svchost.exe (PID: 5820 cmdline: C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: 302B13223DB8C63367C43B004B9395D8)

cmd.exe (PID: 6740 cmdline: cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7040 cmdline: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5068 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 2588 cmdline: cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Redline Clipper

{"Wallet Addresses": ["0xe83e13519074b66ED4fEa23Bf8B18402417504cf", "DFHGrZZVdeJioKHuMtJsT8BjRa7JACkJ8x", "LQ3N47jbUeN1ncAxjL2bQxdbfrTv6DQEwq", "XwPYYFb9s2fCKgZdRJTSLkGy79rNXRnSqM", "46iBmeV6Z5VFEi6q4iGT8A7nzuxwA3AHsZajPsLEbHhFhDEs1SAk3jWWiNdn5CWRHxdsnqvEomjGT3pECWB7BTpsPGEi6Yu"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.480610988.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedlineClipper	Yara detected Redline Clipper	Joe Security
00000009.00000002.488605181.0000000003371000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedlineClipper	Yara detected Redline Clipper	Joe Security
Process Memory Space: OmPnD1qvad.exe PID: 6544	JoeSecurity_RedlineClipper	Yara detected Redline Clipper	Joe Security
Process Memory Space: svchost.exe PID: 6828	JoeSecurity_RedlineClipper	Yara detected Redline Clipper	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.OmPnD1qvad.exe.24cfe38.0.raw.unpack	JoeSecurity_RedlineClipper	Yara detected Redline Clipper	Joe Security
9.2.svchost.exe.339ff34.0.raw.unpack	JoeSecurity_RedlineClipper	Yara detected Redline Clipper	Joe Security

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f, CommandLine: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\OmPnD1qvad.exe, ParentImage: C:\Users\user\Desktop\OmPnD1qvad.exe, ParentProcessId: 6544, ParentProcessName: OmPnD1qvad.exe, ProcessCommandLine: "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f, ProcessId: 6768, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.OmPnD1qvad.exe.24cfe38.0.raw.unpack

Malware Configuration Extractor: Redline Clipper {"Wallet Addresses": ["0xe83e13519074b66ED4fEa23Bf8B18402417504cf", "DFHGrZZVdeJioKHuMtJsT8BjRa7JACkJ8x", "LQ3N47jbUeN1ncAxjL2bQxdbfrTv6DQEwq", "XwPYYFb9s2fCKgZdRJTSLkGy79rNXRnSqM", "46iBmeV6Z5VFEi6q4iGT8A7nzuxwA3AHsZajPsLEbHhFhDEs1SAk3jWWiNdn5CWRHxdsnqvEomjGT3pECWB7BTpsPGEi6Yu"]}

Multi AV Scanner detection for submitted file

Source: OmPnD1qvad.exe	ReversingLabs: Detection: 59%
Source: OmPnD1qvad.exe	Virustotal: Detection: 64%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	ReversingLabs: Detection: 59%
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Virustotal: Detection: 64%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: OmPnD1qvad.exe

Joe Sandbox ML: detected

Source: OmPnD1qvad.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: OmPnD1qvad.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: OmPnD1qvad.exe, 00000000.00000002.479946399.00000000005FB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Window created: window name: CLIPBRDWNDCLASS

Source: OmPnD1qvad.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: OmPnD1qvad.exe, 00000000.00000002.480610988.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrack Redline.exe4 vs OmPnD1qvad.exe
Source: OmPnD1qvad.exe, 00000000.00000000.474804324.00000000000CE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBvSsh.exe vs OmPnD1qvad.exe
Source: OmPnD1qvad.exe, 00000000.00000002.479946399.00000000005FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs OmPnD1qvad.exe
Source: OmPnD1qvad.exe, 00000001.00000002.742889499.0000000001489000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs OmPnD1qvad.exe
Source: OmPnD1qvad.exe, 00000001.00000002.744703347.0000000005858000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs OmPnD1qvad.exe
Source: OmPnD1qvad.exe	Binary or memory string: OriginalFilenameBvSsh.exe vs OmPnD1qvad.exe

Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Code function: 0_2_022E1AB4	0_2_022E1AB4
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Code function: 1_2_016EF9B2	1_2_016EF9B2
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Code function: 1_2_016EB634	1_2_016EB634
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Code function: 1_2_016EDEE0	1_2_016EDEE0
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Code function: 1_2_016EDED0	1_2_016EDED0
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 10_2_05C5F950	10_2_05C5F950
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 10_2_05C5B634	10_2_05C5B634
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 10_2_05C5DEDF	10_2_05C5DEDF
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 10_2_05C5DEE0	10_2_05C5DEE0
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05B2D4B4	19_2_05B2D4B4
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05B2D4A8	19_2_05B2D4A8
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05B2B634	19_2_05B2B634
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05B2DEE0	19_2_05B2DEE0
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05B2DED0	19_2_05B2DED0
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05B2F950	19_2_05B2F950
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05BFD198	19_2_05BFD198
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05BF5CE8	19_2_05BF5CE8
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05BF6D87	19_2_05BF6D87

Source: C:\Users\user\Desktop\OmPnD1qvad.exe

Code function: 0_2_022E5D00 CreateProcessAsUserA,

0_2_022E5D00

Source: OmPnD1qvad.exe	ReversingLabs: Detection: 59%
Source: OmPnD1qvad.exe	Virustotal: Detection: 64%

Source: OmPnD1qvad.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OmPnD1qvad.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OmPnD1qvad.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OmPnD1qvad.exe C:\Users\user\Desktop\OmPnD1qvad.exe
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Users\user\Desktop\OmPnD1qvad.exe C:\Users\user\Desktop\OmPnD1qvad.exe
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\Desktop\OmPnD1qvad.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Users\user\Desktop\OmPnD1qvad.exe C:\Users\user\Desktop\OmPnD1qvad.exe	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\Desktop\OmPnD1qvad.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Users\user\AppData\Roaming\svchost\svchost.exe C:\Users\user\AppData\Roaming\svchost\svchost.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C mkdir "C:\Users\user\AppData\Roaming\svchost	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C copy "C:\Users\user\AppData\Roaming\svchost\svchost.exe" "C:\Users\user\AppData\Roaming\svchost\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3676:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4708:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6732:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7128:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6068:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5652:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_01

Source: C:\Users\user\Desktop\OmPnD1qvad.exe

File created: C:\Users\user\AppData\Roaming\svchost

Jump to behavior

Source: classification engine

Classification label: mal100.spyw.evad.winEXE@56/4@0/0

Source: C:\Users\user\Desktop\OmPnD1qvad.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: OmPnD1qvad.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: OmPnD1qvad.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05BFAE90 push 00000004h; ret	19_2_05BFAEA6
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05BF9ACF push ecx; ret	19_2_05BF9AD5
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Code function: 19_2_05BF9AC1 push ecx; ret	19_2_05BF9AD5

Source: initial sample	Static PE information: section name: .text entropy: 7.661351728887682
Source: initial sample	Static PE information: section name: .text entropy: 7.661351728887682

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\svchost\svchost.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\svchost\svchost.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\svchost\svchost.exe'" /f

Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OmPnD1qvad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost\svchost.exe	Process information set: NOOPENFILEERRORBOX

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
OmPnD1qvad.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Redline Clipper

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OmPnD1qvad.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Redline Clipper

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Windows Analysis Report
OmPnD1qvad.exe