Windows Analysis Report
PO 2_5_24.xlam.xlsx

Overview

General Information

Sample name: PO 2_5_24.xlam.xlsx
Analysis ID: 1435421
MD5: 989feda4871b86bfbcec9debb0b2ec45
SHA1: 05ef3f9b7d77b9709423222a81d670cbcae013cd
SHA256: 26fcc106f92623f06b5eb2e87b2e2e58a2ad9eea51de7d15a15b85dafe44b937
Tags: AgentTeslaxlamxlsx
Infos:

Detection

AgentTesla, PureLog Stealer, RedLine
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Yara detected AgentTesla
Yara detected PureLog Stealer
Yara detected RedLine Stealer
.NET source code contains method to dynamically call methods (often used by packers)
Binary is likely a compiled AutoIt script file
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Shellcode detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: PO 2_5_24.xlam.xlsx Avira: detected
Found malware configuration
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.kino2.top", "Username": "serverizu09@kino2.top", "Password": " XY%R[udi4U]= "}
Multi AV Scanner detection for domain / URL
Source: http://23.94.54.101/ISW.exe Virustotal: Detection: 6% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\CKK.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\CKK.exe Virustotal: Detection: 40% Perma Link
Multi AV Scanner detection for submitted file
Source: PO 2_5_24.xlam.xlsx Virustotal: Detection: 53% Perma Link
Source: PO 2_5_24.xlam.xlsx ReversingLabs: Detection: 63%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\CKK.exe Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 23.94.54.101 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\CKK.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\CKK.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.22:49162 version: TLS 1.2
Source: Binary string: _.pdb source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: CKK.exe, 00000003.00000003.446352254.0000000000F70000.00000004.00001000.00020000.00000000.sdmp, CKK.exe, 00000003.00000003.446225699.0000000002D70000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 3_2_00EADBBE
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E7C2A2 FindFirstFileExW, 3_2_00E7C2A2
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB68EE FindFirstFileW,FindClose, 3_2_00EB68EE
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 3_2_00EB698F
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00EAD076
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00EAD3A9
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00EB9642
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00EB979D
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 3_2_00EB9B2B
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB5C97 FindFirstFileW,FindNextFileW,FindClose, 3_2_00EB5C97

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590378 CreateFileW, 2_2_03590378
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590477 WriteFile, 2_2_03590477
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0359040F WriteFile, 2_2_0359040F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590502 WriteFile,CreateProcessW,ExitProcess, 2_2_03590502
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035903AF LoadLibraryW, 2_2_035903AF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035905A1 CreateProcessW,ExitProcess, 2_2_035905A1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590259 CreateFileW, 2_2_03590259
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0359045B WriteFile, 2_2_0359045B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900DA CreateFileW, 2_2_035900DA
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035905DD ExitProcess, 2_2_035905DD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900DD CreateFileW, 2_2_035900DD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035902D0 ExitProcess,CreateFileW, 2_2_035902D0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900D4 CreateFileW, 2_2_035900D4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900D6 CreateFileW, 2_2_035900D6
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035904C4 WriteFile,CreateProcessW,ExitProcess, 2_2_035904C4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0359007B CreateFileW, 2_2_0359007B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900FA CreateFileW, 2_2_035900FA
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0359007F CreateFileW, 2_2_0359007F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590071 CreateFileW, 2_2_03590071
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590075 CreateFileW, 2_2_03590075
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035902E9 CreateFileW, 2_2_035902E9
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035904E8 WriteFile,CreateProcessW,ExitProcess, 2_2_035904E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900EB CreateFileW, 2_2_035900EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590563 CreateProcessW,ExitProcess, 2_2_03590563
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590365 CreateFileW, 2_2_03590365
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590098 CreateFileW, 2_2_03590098
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0359009F CreateFileW, 2_2_0359009F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590113 CreateFileW, 2_2_03590113
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590092 CreateFileW, 2_2_03590092
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590094 CreateFileW, 2_2_03590094
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590089 CreateFileW, 2_2_03590089
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0359008E CreateFileW, 2_2_0359008E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590101 CreateFileW, 2_2_03590101
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590580 CreateProcessW,ExitProcess, 2_2_03590580
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590305 CreateFileW, 2_2_03590305
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590107 CreateFileW, 2_2_03590107
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900B2 CreateFileW, 2_2_035900B2
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900B4 CreateFileW, 2_2_035900B4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900B6 CreateFileW, 2_2_035900B6
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590136 CreateFileW, 2_2_03590136
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035904A8 WriteFile, 2_2_035904A8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900AB CreateFileW, 2_2_035900AB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0359032C CreateFileW, 2_2_0359032C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900AE CreateFileW, 2_2_035900AE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035900A1 CreateFileW, 2_2_035900A1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590123 CreateFileW, 2_2_03590123
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: api.ipify.org
Source: global traffic DNS query: name: api.ipify.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.26.12.205:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 23.94.54.101:80
Source: global traffic TCP traffic: 23.94.54.101:80 -> 192.168.2.22:49161
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Thu, 02 May 2024 19:48:58 GMTAccept-Ranges: bytesETag: W/"57b5b9c5c99cda1:0"Server: Microsoft-IIS/8.5Date: Thu, 02 May 2024 15:39:45 GMTContent-Length: 1219072Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7d 61 33 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 ea 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 12 00 00 04 00 00 d4 4e 13 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 fc 2e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 12 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 fc 2e 05 00 00 40 0d 00 00 30 05 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 70 12 00 00 76 00 00 00 24 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ISW.exe HTTP/1.1Connection: Keep-AliveHost: 23.94.54.101
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe DNS query: name: api.ipify.org
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe DNS query: name: api.ipify.org
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: unknown TCP traffic detected without corresponding DNS query: 23.94.54.101
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EBCE44 InternetReadFile,SetEvent,GetLastError,SetEvent, 3_2_00EBCE44
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ISW.exe HTTP/1.1Connection: Keep-AliveHost: 23.94.54.101
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: EQNEDT32.EXE, 00000002.00000002.444421814.000000000065F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.444421814.0000000000690000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://23.94.54.101/ISW.exe
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002556000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipif8z
Source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.00000000024FC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608397603.00000000005B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/T
Source: RegSvcs.exe, 00000004.00000002.608494898.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608494898.0000000002538000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: RegSvcs.exe, 00000004.00000002.608641256.00000000056F4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608641256.00000000056E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.22:49162 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, abAX9N.cs .Net Code: _7wfqbBU
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EBEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 3_2_00EBEAFF
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EBED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 3_2_00EBED6A
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EBEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 3_2_00EBEAFF
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput, 3_2_00EAAA57
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00ED9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 3_2_00ED9576

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sheet1.xml, type: SAMPLE Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects RedLine infostealer Author: ditekSHen
Binary is likely a compiled AutoIt script file
Source: CKK.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: CKK.exe, 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_f4a7f36d-1
Source: CKK.exe, 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_d9a6df5a-0
Source: CKK.exe.2.dr String found in binary or memory: This is a third-party compiled AutoIt script. memstr_9ae924c8-b
Source: CKK.exe.2.dr String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_cbbf9510-c
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\CKK.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAD5EB: CreateFileW,DeviceIoControl,CloseHandle, 3_2_00EAD5EB
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 3_2_00EA1201
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 3_2_00EAE8F6
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E48060 3_2_00E48060
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB2046 3_2_00EB2046
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA8298 3_2_00EA8298
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E7E4FF 3_2_00E7E4FF
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E7676B 3_2_00E7676B
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00ED4873 3_2_00ED4873
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E4CAF0 3_2_00E4CAF0
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E6CAA0 3_2_00E6CAA0
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E5CC39 3_2_00E5CC39
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E76DD9 3_2_00E76DD9
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E5D071 3_2_00E5D071
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E491C0 3_2_00E491C0
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E5B119 3_2_00E5B119
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E61394 3_2_00E61394
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E61706 3_2_00E61706
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E6781B 3_2_00E6781B
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E619B0 3_2_00E619B0
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E5997D 3_2_00E5997D
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E47920 3_2_00E47920
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E67A4A 3_2_00E67A4A
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E67CA7 3_2_00E67CA7
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E61C77 3_2_00E61C77
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E79EEE 3_2_00E79EEE
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00ECBE44 3_2_00ECBE44
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E61F32 3_2_00E61F32
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00113640 3_2_00113640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00408C60 4_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0040DC11 4_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00407C3F 4_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00418CCC 4_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00406CA0 4_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_004028B0 4_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0041A4BE 4_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00418244 4_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00401650 4_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00402F20 4_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_004193C4 4_2_004193C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00418788 4_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00402F89 4_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00402B90 4_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_004073A0 4_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0027D428 4_2_0027D428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0027C810 4_2_0027C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00271030 4_2_00271030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00270E7B 4_2_00270E7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0027CB58 4_2_0027CB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D30FC0 4_2_00D30FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D334C0 4_2_00D334C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D6AC08 4_2_00D6AC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D66508 4_2_00D66508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D69A78 4_2_00D69A78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D63208 4_2_00D63208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D68C59 4_2_00D68C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D6BD18 4_2_00D6BD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D6513C 4_2_00D6513C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D668C0 4_2_00D668C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00D632C1 4_2_00D632C1
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: PO 2_5_24.xlam.xlsx OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: String function: 00E60A30 appears 46 times
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: String function: 00E5F9F2 appears 40 times
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: String function: 00E49CB3 appears 31 times
Yara signature match
Source: sheet1.xml, type: SAMPLE Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, RsYAkkzVoy.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, Kqqzixk.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, xROdzGigX.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, ywes.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, iPVW0zV.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, 1Pi9sgbHwoV.cs Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, YUgDfWK2g4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, YUgDfWK2g4.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, MarWtcu.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winXLSX@6/8@2/2
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB37B5 GetLastError,FormatMessageW, 3_2_00EB37B5
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA10BF AdjustTokenPrivileges,CloseHandle, 3_2_00EA10BF
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 3_2_00EA16C3
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 3_2_00EB51CD
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00ECA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 3_2_00ECA67C
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize, 3_2_00EB648E
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 3_2_00E442A2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$PO 2_5_24.xlam.xlsx Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR64BB.tmp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PO 2_5_24.xlam.xlsx Virustotal: Detection: 53%
Source: PO 2_5_24.xlam.xlsx ReversingLabs: Detection: 63%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\CKK.exe "C:\Users\user\AppData\Roaming\CKK.exe"
Source: C:\Users\user\AppData\Roaming\CKK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\CKK.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\CKK.exe "C:\Users\user\AppData\Roaming\CKK.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\CKK.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: credssp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: PO 2_5_24.xlam.xlsx Initial sample: OLE zip file path = xl/media/image1.jpg
Source: PO 2_5_24.xlam.xlsx Initial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: _.pdb source: RegSvcs.exe, 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: CKK.exe, 00000003.00000003.446352254.0000000000F70000.00000004.00001000.00020000.00000000.sdmp, CKK.exe, 00000003.00000003.446225699.0000000002D70000.00000004.00001000.00020000.00000000.sdmp
Source: PO 2_5_24.xlam.xlsx Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00E442DE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E60A76 push ecx; ret 3_2_00E60A89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0041C40C push cs; iretd 4_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00423149 push eax; ret 4_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0041C50E push cs; iretd 4_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_004231C8 push eax; ret 4_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0040E21D push ecx; ret 4_2_0040E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0041C6BE push ebx; ret 4_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00273725 push ss; ret 4_2_00273729
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00274316 pushfd ; iretd 4_2_00274319
Source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, WP6RZJql8gZrNhVA9v.cs High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'L9ASkpV85GROR', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\CKK.exe Jump to dropped file
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E5F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 3_2_00E5F98E
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00ED1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 3_2_00ED1C41
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590242 rdtsc 2_2_03590242
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 4_2_004019F0
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Roaming\CKK.exe API coverage: 4.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2008 Thread sleep time: -120000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 3_2_00EADBBE
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E7C2A2 FindFirstFileExW, 3_2_00E7C2A2
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB68EE FindFirstFileW,FindClose, 3_2_00EB68EE
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 3_2_00EB698F
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00EAD076
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 3_2_00EAD3A9
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00EB9642
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_00EB979D
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 3_2_00EB9B2B
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EB5C97 FindFirstFileW,FindNextFileW,FindClose, 3_2_00EB5C97
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00E442DE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe API call chain: ExitProcess graph end node
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03590242 rdtsc 2_2_03590242
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EBEAA2 BlockInput, 3_2_00EBEAA2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00E72622
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 4_2_004019F0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00E442DE
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035905E4 mov edx, dword ptr fs:[00000030h] 2_2_035905E4
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E64CE8 mov eax, dword ptr fs:[00000030h] 3_2_00E64CE8
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_001134D0 mov eax, dword ptr fs:[00000030h] 3_2_001134D0
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00113530 mov eax, dword ptr fs:[00000030h] 3_2_00113530
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00111ED0 mov eax, dword ptr fs:[00000030h] 3_2_00111ED0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 3_2_00EA0B62
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E609D5 SetUnhandledExceptionFilter, 3_2_00E609D5
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00E72622
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E6083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00E6083F
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E60C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_00E60C21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0040CE09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0040E61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00416F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 4_2_004123F1 SetUnhandledExceptionFilter, 4_2_004123F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\CKK.exe Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Roaming\CKK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 3_2_00EA1201
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E82BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 3_2_00E82BA5
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EAB226 SendInput,keybd_event, 3_2_00EAB226
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EC22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event, 3_2_00EC22DA
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\CKK.exe "C:\Users\user\AppData\Roaming\CKK.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\CKK.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 3_2_00EA0B62
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EA1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 3_2_00EA1663
Source: CKK.exe, 00000003.00000002.447747502.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, CKK.exe.2.dr Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: CKK.exe Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E60698 cpuid 3_2_00E60698
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: GetLocaleInfoA, 4_2_00417A20
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E7333F GetSystemTimeAsFileTime, 3_2_00E7333F
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E9D27A GetUserNameW, 3_2_00E9D27A
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E7B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 3_2_00E7B952
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 3_2_00E442DE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 1128, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected RedLine Stealer
Source: Yara match File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: CKK.exe Binary or memory string: WIN_81
Source: CKK.exe Binary or memory string: WIN_XP
Source: CKK.exe.2.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: CKK.exe Binary or memory string: WIN_XPe
Source: CKK.exe Binary or memory string: WIN_VISTA
Source: CKK.exe Binary or memory string: WIN_7
Source: CKK.exe Binary or memory string: WIN_8
Yara detected Credential Stealer
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608494898.0000000002493000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 1128, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegSvcs.exe PID: 1128, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6f04e.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.450ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.4c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3497170.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.3446458.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.a6ff36.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.608390113.00000000004C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608372790.0000000000450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608574126.0000000003441000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.608436273.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected RedLine Stealer
Source: Yara match File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.CKK.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.608358959.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.447488825.0000000000140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EC1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 3_2_00EC1204
Source: C:\Users\user\AppData\Roaming\CKK.exe Code function: 3_2_00EC1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 3_2_00EC1806
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1435421 Sample: PO 2_5_24.xlam.xlsx Startdate: 02/05/2024 Architecture: WINDOWS Score: 100 28 Multi AV Scanner detection for domain / URL 2->28 30 Found malware configuration 2->30 32 Malicious sample detected (through community Yara rule) 2->32 34 17 other signatures 2->34 8 EXCEL.EXE 6 11 2->8         started        process3 process4 10 EQNEDT32.EXE 1 8->10         started        dnsIp5 26 23.94.54.101, 49161, 80 AS-COLOCROSSINGUS United States 10->26 22 C:\Users\user\AppData\Roaming\CKK.exe, PE32 10->22 dropped 44 Office equation editor establishes network connection 10->44 46 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->46 15 CKK.exe 4 10->15         started        file6 signatures7 process8 signatures9 48 Multi AV Scanner detection for dropped file 15->48 50 Binary is likely a compiled AutoIt script file 15->50 52 Machine Learning detection for dropped file 15->52 54 2 other signatures 15->54 18 RegSvcs.exe 12 2 15->18         started        process10 dnsIp11 24 api.ipify.org 104.26.12.205, 443, 49162 CLOUDFLARENETUS United States 18->24 36 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->36 38 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->38 40 Tries to steal Mail credentials (via file / registry access) 18->40 42 2 other signatures 18->42 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.26.12.205
 api.ipify.org United States
13335 CLOUDFLARENETUS false
23.94.54.101
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted Domains

Name IP Active
api.ipify.org 104.26.12.205 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high
    http://23.94.54.101/ISW.exe true
    • 7%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown