Analysis Report DOC000YUT600.scr

Overview

General Information

Joe Sandbox Version:	23.0.0
Analysis ID:	648369
Start date:	29.08.2018
Start time:	09:58:45
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 11m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DOC000YUT600.scr (renamed file extension from scr to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@10/5@0/1
EGA Information:	Successful, ratio: 33.3%
HDC Information:	Successful, ratio: 99.9% (good quality ratio 90.9%) Quality average: 76.9% Quality standard deviation: 31.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe Execution Graph export aborted for target DOC000YUT600.exe, PID 3420 because it is empty Execution Graph export aborted for target Regdriver.exe, PID 3484 because it is empty Execution Graph export aborted for target regdrv.exe, PID 3452 because it is empty Execution Graph export aborted for target regdrv.exe, PID 3532 because it is empty Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Contains functionality to modify the execution of threads in other processes

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\Videos\Regdriver.exe	Avira: Label: HEUR/AGEN.1032427
Source: C:\Users\user\Music\regdrv.exe	Avira: Label: HEUR/AGEN.1032427

Antivirus detection for submitted file

Show sources

Source: DOC000YUT60.exe

Avira: Label: HEUR/AGEN.1032427

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\Music\regdrv.exe	virustotal: Detection: 60%			Perma Link
Source: C:\Users\user\Videos\Regdriver.exe	virustotal: Detection: 60%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: DOC000YUT60.exe

virustotal: Detection: 60%

Perma Link

Antivirus detection for unpacked file

Show sources

Source: 5.2.regdrv.exe.2580000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.0.regdrv.exe.400000.4.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.2.regdrv.exe.400000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.0.regdrv.exe.400000.4.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 2.2.regdrv.exe.25d0000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.1.regdrv.exe.400000.0.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 6.0.regdrv.exe.400000.5.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.2.regdrv.exe.400000.3.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.0.regdrv.exe.400000.5.unpack	Avira: Label: BDS/DarkKomet.GS
Source: 3.1.regdrv.exe.400000.0.unpack	Avira: Label: BDS/DarkKomet.GS

Yara signature match

Show sources

Source: 00000006.00000000.479399059.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000001.481410763.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000001.481410763.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000006.00000000.479399059.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000003.450764221.7F370000.00000004.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000005.00000002.491857687.02580000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000005.00000002.491857687.02580000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000002.00000002.462554403.025D0000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000002.00000002.462554403.025D0000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000001.447610474.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000001.447610474.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000002.699224479.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000002.699224479.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000006.00000000.479959577.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000000.479959577.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000006.00000002.482534154.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000006.00000002.482534154.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000000.446776706.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000000.446776706.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000005.00000003.485657484.7F370000.00000004.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 00000003.00000000.446217367.00400000.00000040.sdmp, type: MEMORY	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 00000003.00000000.446217367.00400000.00000040.sdmp, type: MEMORY	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 5.2.regdrv.exe.2580000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 5.2.regdrv.exe.2580000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 2.2.regdrv.exe.25d0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 2.2.regdrv.exe.25d0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 5.2.regdrv.exe.2580000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 5.2.regdrv.exe.2580000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 2.2.regdrv.exe.25d0000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 2.2.regdrv.exe.25d0000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.2.regdrv.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.2.regdrv.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.0.regdrv.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 6.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 6.0.regdrv.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.1.regdrv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet
Source: 3.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 3.1.regdrv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_DarkComet date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects DarkComet RAT, reference = http://malwareconfig.com/stats/DarkComet

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00342EA8 FindFirstFileA,GetLastError,	1_3_00342EA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0040A488 FindFirstFileA,GetLastError,	3_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	3_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00480FEC FindFirstFileA,	3_2_00480FEC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002A66A8 FindFirstFileA,GetLastError,	4_3_002A66A8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0040A488 FindFirstFileA,GetLastError,	6_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	6_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00480FEC FindFirstFileA,	6_2_00480FEC

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.82:49188 -> 95.140.125.42:1908

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.140.125.42

Contains functionality to upload files via FTP

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00473560 FtpPutFileA,		3_2_00473560
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00473560 FtpPutFileA,		6_2_00473560

Internet Provider seen in connection with other malware

Show sources

Source: Joe Sandbox View

ASN Name: ORIONTELEKOM-ASRS ORIONTELEKOM-ASRS

Contains functionality to download additional files from the internet

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004865E0 Sleep,TranslateMessage,DispatchMessageA,PeekMessageA,socket,ntohs,inet_addr,gethostbyname,connect,recv,shutdown,closesocket,

3_2_004865E0

Urls found in memory or binary data

Show sources

Source: regdrv.exe, 00000002.00000002.451751956.013B0000.00000004.sdmp

String found in binary or memory: http://SAC.home-page.org

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to capture and log keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: [ESC]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F1]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F2]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [INS]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [SNAPSHOT]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [LEFT]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [RIGHT]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DOWN]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [UP]	3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [ESC]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F1]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [F2]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DEL]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [INS]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [SNAPSHOT]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [LEFT]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [RIGHT]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [DOWN]	6_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: [UP]	6_2_004818F8

Contains functionality to log keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,

3_2_004818F8

Contains functionality to log keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,		3_2_004818F8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,		6_2_004818F8

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00481ED8 SetWindowsHookExA 0000000D,004818F8,00000000,00000000

3_2_00481ED8

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Music\regdrv.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Music\regdrv.exe

Jump to behavior

Contains functionality for read data from the clipboard

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0040838E OpenClipboard,

3_2_0040838E

Contains functionality to read the clipboard data

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00428418 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,

3_2_00428418

Contains functionality to record screenshots

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00428B08 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

3_2_00428B08

Contains functionality to retrieve information about pressed keystrokes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004818F8 CallNextHookEx,CallNextHookEx,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyA,ToAscii,CallNextHookEx,

3_2_004818F8

Spam, unwanted Advertisements and Ransom Demands:

Contains functionalty to change the wallpaper

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048BB34 SystemParametersInfoA,		6_2_0048BB34
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00489E9C SystemParametersInfoA,		6_2_00489E9C

System Summary:

PE file contains more sections than normal

Show sources

Source: Regdriver.exe.1.dr	Static PE information: Number of sections : 11 > 10
Source: DOC000YUT60.exe	Static PE information: Number of sections : 11 > 10
Source: regdrv.exe.1.dr	Static PE information: Number of sections : 11 > 10

PE file has a writeable .text section

Show sources

Source: DOC000YUT60.exe	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: regdrv.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: Regdriver.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Contains functionality to call native functions

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004865E0 Sleep,TranslateMessage,DispatchMessageA,PeekMessageA,socket,ntohs,inet_addr,gethostbyname,connect,recv,shutdown,closesocket,	3_2_004865E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004801FC socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,send,recv,recv,recv,shutdown,closesocket,	3_2_004801FC
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004821A0 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,sendto,Sleep,closesocket,ExitThread,	3_2_004821A0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048851C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,mouse_event,shutdown,closesocket,	3_2_0048851C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00460628 inet_addr,ntohs,	3_2_00460628
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00482630 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	3_2_00482630
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004607A4 getservbyname,ntohs,	3_2_004607A4
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00480880 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,shutdown,closesocket,shutdown,closesocket,	3_2_00480880
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00486918 recv,recv,send,send,recv,send,send,send,send,send,recv,recv,recv,gethostbyname,ntohs,socket,connect,getsockname,send,select,recv,send,recv,send,Sleep,closesocket,closesocket,	3_2_00486918
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048298C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,closesocket,ExitThread,closesocket,ExitThread,	3_2_0048298C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,	3_2_00486E2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048317C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	3_2_0048317C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00489244 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	3_2_00489244
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0047F4E0 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,recv,shutdown,closesocket,	3_2_0047F4E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004836D8 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	3_2_004836D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0047FA8C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,GetDeviceCaps,BitBlt,send,recv,SelectObject,DeleteObject,DeleteObject,ReleaseDC,shutdown,closesocket,	3_2_0047FA8C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004801FC socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,send,recv,recv,recv,shutdown,closesocket,	6_2_004801FC
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004821A0 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,sendto,Sleep,closesocket,ExitThread,	6_2_004821A0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048851C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,mouse_event,shutdown,closesocket,	6_2_0048851C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004865E0 Sleep,TranslateMessage,DispatchMessageA,PeekMessageA,socket,ntohs,inet_addr,gethostbyname,connect,recv,shutdown,closesocket,	6_2_004865E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00460628 inet_addr,ntohs,	6_2_00460628
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00482630 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	6_2_00482630
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004607A4 getservbyname,ntohs,	6_2_004607A4
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00480880 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,shutdown,closesocket,shutdown,closesocket,	6_2_00480880
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00486918 recv,recv,send,send,recv,send,send,send,send,send,recv,recv,recv,gethostbyname,ntohs,socket,connect,getsockname,send,select,recv,send,recv,send,Sleep,closesocket,closesocket,	6_2_00486918
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048298C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,closesocket,ExitThread,closesocket,ExitThread,	6_2_0048298C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,	6_2_00486E2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048317C socket,ExitThread,ntohs,inet_addr,gethostbyname,ExitThread,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	6_2_0048317C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00489244 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,send,recv,shutdown,closesocket,ExitThread,	6_2_00489244
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0047F4E0 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,recv,recv,shutdown,closesocket,	6_2_0047F4E0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004836D8 socket,ExitThread,inet_addr,ntohs,gethostbyname,ExitThread,connect,ExitThread,recv,Sleep,closesocket,ExitThread,	6_2_004836D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0047FA8C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,GetDeviceCaps,BitBlt,send,recv,SelectObject,DeleteObject,DeleteObject,ReleaseDC,shutdown,closesocket,	6_2_0047FA8C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00487B54 CoInitialize,socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,send,recv,shutdown,closesocket,	6_2_00487B54
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0047FE20 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,send,shutdown,closesocket,	6_2_0047FE20
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00485F40 socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,	6_2_00485F40
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00487F2C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,Sleep,send,recv,shutdown,closesocket,	6_2_00487F2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00473F34 CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,TerminateProcess,	6_2_00473F34

Contains functionality to delete services

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004715B0 OpenSCManagerA,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,

3_2_004715B0

Contains functionality to shutdown / reboot the system

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		3_2_0048A070
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		6_2_0048A070

Creates mutexes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Mutant created: \Sessions\1\BaseNamedObjects\DCMIN_MUTEX-JY7PNMH

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D07E	1_3_0034D07E
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D9FC	1_3_0034D9FC
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00347200	1_3_00347200
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D29E	1_3_0034D29E
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00351331	1_3_00351331
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034DBD8	1_3_0034DBD8
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D4BC	1_3_0034D4BC
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CCD1	1_3_0034CCD1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D566	1_3_0034D566
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034D568	1_3_0034D568
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CDD6	1_3_0034CDD6
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00347DCA	1_3_00347DCA
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034AFC9	1_3_0034AFC9
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_004021D8	1_2_004021D8
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034AFD4	1_3_0034AFD4
Source: C:\Users\user\Music\regdrv.exe	Code function: 2_2_004021D8	2_2_004021D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00402370	3_2_00402370
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004064C0	3_2_004064C0
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0043E644	3_2_0043E644
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004389B4	3_2_004389B4
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0045EC78	3_2_0045EC78
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0046ADBC	3_2_0046ADBC
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0046797C	3_2_0046797C
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B087E	4_3_002B087E
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B11FC	4_3_002B11FC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AAA00	4_3_002AAA00
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0A9E	4_3_002B0A9E
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B4B31	4_3_002B4B31
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B13D8	4_3_002B13D8
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0CBC	4_3_002B0CBC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B04D1	4_3_002B04D1
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0D68	4_3_002B0D68
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B0D66	4_3_002B0D66
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AB5CA	4_3_002AB5CA
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002B05D6	4_3_002B05D6
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AE7C9	4_3_002AE7C9
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_2_004021D8	4_2_004021D8
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002AE7D4	4_3_002AE7D4
Source: C:\Users\user\Music\regdrv.exe	Code function: 5_2_004021D8	5_2_004021D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00402370	6_2_00402370
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004064C0	6_2_004064C0
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0043E644	6_2_0043E644
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004389B4	6_2_004389B4
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0045EC78	6_2_0045EC78
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0046ADBC	6_2_0046ADBC
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0046797C	6_2_0046797C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00469B90	6_2_00469B90

Enables driver privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe

Process token adjusted: Load Driver

Jump to behavior

Enables security privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe

Process token adjusted: Security

Jump to behavior

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00407B10 appears 276 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004735E8 appears 75 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00407688 appears 36 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00407B08 appears 65 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004100C4 appears 40 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405584 appears 117 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00406F68 appears 32 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00474D58 appears 46 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 0040EF4C appears 42 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004055C8 appears 72 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004043B0 appears 46 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 0041163C appears 38 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405974 appears 32 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00404F34 appears 36 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405818 appears 40 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00404F10 appears 162 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004218E4 appears 149 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00404A1C appears 32 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405554 appears 31 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405530 appears 130 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 004104C4 appears 42 times
Source: C:\Users\user\Music\regdrv.exe	Code function: String function: 00405864 appears 57 times
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: String function: 00404F10 appears 81 times
Source: C:\Users\user\Videos\Regdriver.exe	Code function: String function: 00404F10 appears 81 times

PE file contains strange resources

Show sources

Source: DOC000YUT60.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DOC000YUT60.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: regdrv.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Regdriver.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Show sources

Source: DOC000YUT60.exe

Binary or memory string: OriginalFilenamePeaZip. vs DOC000YUT60.exe

PE file has a writable .reloc section

Show sources

Source: DOC000YUT60.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: regdrv.exe.1.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: Regdriver.exe.1.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

PE file contains an invalid data directory

Show sources

Source: DOC000YUT60.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: regdrv.exe.1.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: Regdriver.exe.1.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Classification label

Show sources

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@10/5@0/1

Contains functionality for error logging

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00425A70 GetLastError,FormatMessageA,

3_2_00425A70

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048AEA8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,	3_2_0048AEA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	3_2_0048A070
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048AEA8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,	6_2_0048AEA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0048A070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	6_2_0048A070

Contains functionality to check free disk space

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0040A746 GetDiskFreeSpaceA,

3_2_0040A746

Contains functionality to create services

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,		3_2_00471850
Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,		6_2_00471850

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_2_00407D92 CoCreateInstance,

1_2_00407D92

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048DDE0 FindResourceA,LoadResource,SizeofResource,LockResource,FreeResource,

3_2_0048DDE0

Contains functionality to modify services (start/stop/modify)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004714B8 OpenSCManagerA,OpenServiceA,StartServiceA,ControlService,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,

3_2_004714B8

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

File created: C:\Users\user\Music\regdrv.exe

Jump to behavior

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Videos\Regdriver.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior

Reads ini files

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: DOC000YUT60.exe

virustotal: Detection: 60%

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\DOC000YUT600.exe 'C:\Users\user\Desktop\DOC000YUT600.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe
Source: unknown	Process created: C:\Users\user\Videos\Regdriver.exe 'C:\Users\user\Videos\Regdriver.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'
Source: unknown	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe	Jump to behavior
Source: C:\Users\user\Videos\Regdriver.exe	Process created: C:\Users\user\Music\regdrv.exe 'C:\Users\user\Music\regdrv.exe'	Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Process created: C:\Users\user\Music\regdrv.exe C:\Users\user\Music\regdrv.exe	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Submission file is bigger than most known malware samples

Show sources

Source: DOC000YUT60.exe

Static file information: File size 1816064 > 1048576

PE file has a big raw section

Show sources

Source: DOC000YUT60.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x16f800

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_0034FD78 LoadLibraryA,GetProcAddress,GetModuleHandleA,

1_3_0034FD78

Entry point lies outside standard sections

Show sources

Source: initial sample

Static PE information: section where entry point is pointing to: .data

PE file contains an invalid checksum

Show sources

Source: Regdriver.exe.1.dr	Static PE information: real checksum: 0xf110a should be: 0x1bf325
Source: DOC000YUT60.exe	Static PE information: real checksum: 0xf110a should be: 0x1bf325
Source: regdrv.exe.1.dr	Static PE information: real checksum: 0xf110a should be: 0x1bf325

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00344D14 push 00344D51h; ret	1_3_00344D49
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_003421DD push eax; ret	1_3_00342219
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034C1D9 push esp; retn 0034h	1_3_0034C1E9
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034E24C push ecx; mov dword ptr [esp], edx	1_3_0034E251
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_003422AD push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034FB3C push ebx; ret	1_3_0034FB5D
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034FB3C push eax; ret	1_3_0034FB81
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034232E push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_003423AB push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00342410 push 003424B9h; ret	1_3_003424B1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0035049E push eax; ret	1_3_003504CB
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CCD1 push ecx; mov dword ptr [esp], edx	1_3_0034CCF1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_0034CDD6 push ecx; mov dword ptr [esp], edx	1_3_0034CDDD
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00347DCA push ecx; mov dword ptr [esp], eax	1_3_00347DE1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0040E17C push ecx; mov dword ptr [esp], edx	1_2_0040E181
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041F100 push ecx; mov dword ptr [esp], edx	1_2_0041F105
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041B238 push ecx; mov dword ptr [esp], edx	1_2_0041B23A
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_004172A8 push ecx; mov dword ptr [esp], edx	1_2_004172AD
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_004194A4 push ecx; mov dword ptr [esp], edx	1_2_004194A5
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00417504 push ecx; mov dword ptr [esp], edx	1_2_00417509
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00417668 push ecx; mov dword ptr [esp], edx	1_2_0041766D
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00417624 push ecx; mov dword ptr [esp], edx	1_2_00417629
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041E6B0 push ecx; mov dword ptr [esp], edx	1_2_0041E6B2
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041577C push 004157C9h; ret	1_2_004157C1
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0040E816 push 0040EAC2h; ret	1_2_0040EABA
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00403B70 push eax; ret	1_2_00403BAC
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00414D6E push 00414DE6h; ret	1_2_00414DDE
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_0041FE36 push 0041FEE3h; ret	1_2_0041FEDB
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_2_00406E8E push 00406EEBh; ret	1_2_00406EE3
Source: C:\Users\user\Music\regdrv.exe	Code function: 2_2_0040E17C push ecx; mov dword ptr [esp], edx	2_2_0040E181
Source: C:\Users\user\Music\regdrv.exe	Code function: 2_2_0041F100 push ecx; mov dword ptr [esp], edx	2_2_0041F105

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	File created: C:\Users\user\Music\regdrv.exe			Jump to dropped file
Source: C:\Users\user\Desktop\DOC000YUT600.exe	File created: C:\Users\user\Videos\Regdriver.exe			Jump to dropped file

Boot Survival:

Contains functionality to start windows services

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_004714B8 OpenSCManagerA,OpenServiceA,StartServiceA,ControlService,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,

3_2_004714B8

Creates an autostart registry key

Show sources

Source: C:\Users\user\Music\regdrv.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run Registry Driver			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run Registry Driver			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0042E370 IsIconic,GetWindowPlacement,GetWindowRect,	3_2_0042E370
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00458910 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	3_2_00458910
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_004576CC IsIconic,GetCapture,	3_2_004576CC
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0043B75C IsIconic,	3_2_0043B75C
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0043B7D8 GetWindowLongA,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongA,SetWindowLongA,ShowWindow,ShowWindow,	3_2_0043B7D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0042E370 IsIconic,GetWindowPlacement,GetWindowRect,	6_2_0042E370
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00458910 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	6_2_00458910
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_004576CC IsIconic,GetCapture,	6_2_004576CC
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0043B75C IsIconic,	6_2_0043B75C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0043B7D8 GetWindowLongA,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongA,SetWindowLongA,ShowWindow,ShowWindow,	6_2_0043B7D8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00457FD4 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	6_2_00457FD4

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00460AC0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00460AC0

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Videos\Regdriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_3-39469

Contains functionality to enumerate running services

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,EnumServicesStatusA,CloseServiceHandle,		3_2_00471640
Source: C:\Users\user\Music\regdrv.exe	Code function: OpenSCManagerA,EnumServicesStatusA,CloseServiceHandle,		6_2_00471640

Found evasive API chain (date check)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Found evasive API chain checking for process token information

Show sources

Source: C:\Users\user\Music\regdrv.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-38102

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\Music\regdrv.exe	API coverage: 6.5 %
Source: C:\Users\user\Music\regdrv.exe	API coverage: 4.0 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Music\regdrv.exe TID: 3516	Thread sleep count: 92 > 30			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe TID: 3516	Thread sleep time: -92000s >= -60000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: 1_3_00342EA8 FindFirstFileA,GetLastError,	1_3_00342EA8
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_0040A488 FindFirstFileA,GetLastError,	3_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	3_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00480FEC FindFirstFileA,	3_2_00480FEC
Source: C:\Users\user\Videos\Regdriver.exe	Code function: 4_3_002A66A8 FindFirstFileA,GetLastError,	4_3_002A66A8
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_0040A488 FindFirstFileA,GetLastError,	6_2_0040A488
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00406A68 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	6_2_00406A68
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00480FEC FindFirstFileA,	6_2_00480FEC

Program exit points

Show sources

Source: C:\Users\user\Music\regdrv.exe	API call chain: ExitProcess graph end node	graph_3-39280
Source: C:\Users\user\Music\regdrv.exe	API call chain: ExitProcess graph end node	graph_3-39338
Source: C:\Users\user\Music\regdrv.exe	API call chain: ExitProcess graph end node

Anti Debugging:

Checks for debuggers (devices)

Show sources

Source: C:\Users\user\Music\regdrv.exe	File opened: SIWDEBUG
Source: C:\Users\user\Music\regdrv.exe	File opened: NTICE
Source: C:\Users\user\Music\regdrv.exe	File opened: SICE

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_0034FD78 LoadLibraryA,GetProcAddress,GetModuleHandleA,

1_3_0034FD78

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_00466038 FreeLibrary,VirtualFree,GetProcessHeap,HeapFree,

3_2_00466038

Enables debug privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 6_2_00473F34 CreateProcessA,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,TerminateProcess,

6_2_00473F34

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Music\regdrv.exe	Memory written: C:\Users\user\Music\regdrv.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Memory written: C:\Users\user\Music\regdrv.exe base: 400000 value starts with: 4D5A			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Thread register set: target process: 3468			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Thread register set: target process: 3540			Jump to behavior

Contains functionality to launch a program with higher privileges

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048A218 ShellExecuteExA,

3_2_0048A218

Contains functionality to simulate keystroke presses

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048B42C keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,

3_2_0048B42C

Contains functionality to simulate mouse events

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048851C socket,ntohs,inet_addr,gethostbyname,connect,recv,recv,recv,mouse_event,shutdown,closesocket,

3_2_0048851C

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh<
Source: regdrv.exe	Binary or memory string: Shell_TrayWnd
Source: regdrv.exe	Binary or memory string: Progman
Source: 2018-08-29-4.dc.3.dr	Binary or memory string: :: Program Manager (10:00:23 AM)
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_TrayWndjjh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Progmanjhh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndTrayNotifyWndjh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: ProgmanU
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndTrayNotifyWndTrayClockWClassjh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: ButtonShell_TrayWndj
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndReBarWindow32jh
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_traywndReBarWindow32jhD
Source: regdrv.exe	Binary or memory string: Shell_traywnd
Source: regdrv.exe, 00000002.00000003.450764221.7F370000.00000004.sdmp	Binary or memory string: Shell_TrayWndPjjh

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: GetLocaleInfoA,	1_3_00343A28
Source: C:\Users\user\Desktop\DOC000YUT600.exe	Code function: GetLocaleInfoA,	1_3_00343A74
Source: C:\Users\user\Music\regdrv.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_00406C2C
Source: C:\Users\user\Music\regdrv.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_00406D38
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	3_2_0048CEEC
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	3_2_0040D334
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	3_2_0040D380
Source: C:\Users\user\Videos\Regdriver.exe	Code function: GetLocaleInfoA,	4_3_002A7228
Source: C:\Users\user\Videos\Regdriver.exe	Code function: GetLocaleInfoA,	4_3_002A7274
Source: C:\Users\user\Music\regdrv.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	6_2_00406C2C
Source: C:\Users\user\Music\regdrv.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	6_2_00406D38
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	6_2_0048CEEC
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	6_2_0040D334
Source: C:\Users\user\Music\regdrv.exe	Code function: GetLocaleInfoA,	6_2_0040D380

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_0034C02C cpuid

1_3_0034C02C

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\Music\regdrv.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Music\regdrv.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_003439A4 GetLocalTime,

1_3_003439A4

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\Music\regdrv.exe

Code function: 3_2_0048CE74 GetUserNameA,

3_2_0048CE74

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\DOC000YUT600.exe

Code function: 1_3_00344440 GetVersionExA,

1_3_00344440

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\Users\user\Music\regdrv.exe	Code function: 3_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,		3_2_00486E2C
Source: C:\Users\user\Music\regdrv.exe	Code function: 6_2_00486E2C socket,ntohs,bind,listen,accept,LocalAlloc,CreateThread,CloseHandle,Sleep,ExitThread,		6_2_00486E2C

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
09:59:41	API Interceptor	2x Sleep call for process: DOC000YUT600.exe modified
09:59:48	API Interceptor	6x Sleep call for process: regdrv.exe modified
09:59:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry Driver C:\Users\user\Videos\Regdriver.exe
09:59:56	API Interceptor	2x Sleep call for process: Regdriver.exe modified

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DOC000YUT60.exe	61%	virustotal		Browse
DOC000YUT60.exe	9%	metadefender		Browse
DOC000YUT60.exe	100%	Avira	HEUR/AGEN.1032427

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Videos\Regdriver.exe	100%	Avira	HEUR/AGEN.1032427
C:\Users\user\Music\regdrv.exe	100%	Avira	HEUR/AGEN.1032427
C:\Users\user\Music\regdrv.exe	61%	virustotal		Browse
C:\Users\user\Music\regdrv.exe	9%	metadefender		Browse
C:\Users\user\Videos\Regdriver.exe	61%	virustotal		Browse
C:\Users\user\Videos\Regdriver.exe	9%	metadefender		Browse

Unpacked PE Files

Source	Detection	Scanner	Label
5.2.regdrv.exe.2580000.3.unpack	100%	Avira	BDS/DarkKomet.GS
6.0.regdrv.exe.400000.4.unpack	100%	Avira	BDS/DarkKomet.GS
6.2.regdrv.exe.400000.3.unpack	100%	Avira	BDS/DarkKomet.GS
3.0.regdrv.exe.400000.4.unpack	100%	Avira	BDS/DarkKomet.GS
2.2.regdrv.exe.25d0000.3.unpack	100%	Avira	BDS/DarkKomet.GS
6.1.regdrv.exe.400000.0.unpack	100%	Avira	BDS/DarkKomet.GS
6.0.regdrv.exe.400000.5.unpack	100%	Avira	BDS/DarkKomet.GS
3.2.regdrv.exe.400000.3.unpack	100%	Avira	BDS/DarkKomet.GS
3.0.regdrv.exe.400000.5.unpack	100%	Avira	BDS/DarkKomet.GS
3.1.regdrv.exe.400000.0.unpack	100%	Avira	BDS/DarkKomet.GS

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://SAC.home-page.org	0%	virustotal		Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.479399059.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000001.481410763.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000001.481410763.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000000.479399059.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000002.00000003.450764221.7F370000.00000004.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000005.00000002.491857687.02580000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000005.00000002.491857687.02580000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000002.00000002.462554403.025D0000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000002.00000002.462554403.025D0000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000001.447610474.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000001.447610474.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000002.699224479.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000002.699224479.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000000.479959577.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000000.479959577.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000002.482534154.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000006.00000002.482534154.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000000.446776706.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000000.446776706.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000005.00000003.485657484.7F370000.00000004.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000000.446217367.00400000.00000040.sdmp	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
00000003.00000000.446217367.00400000.00000040.sdmp	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>

Unpacked PEs

Source	Rule	Description	Author
6.1.regdrv.exe.400000.0.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.1.regdrv.exe.400000.0.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
5.2.regdrv.exe.2580000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
5.2.regdrv.exe.2580000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.2.regdrv.exe.400000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.2.regdrv.exe.400000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.5.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.5.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
2.2.regdrv.exe.25d0000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
2.2.regdrv.exe.25d0000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
5.2.regdrv.exe.2580000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
5.2.regdrv.exe.2580000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
2.2.regdrv.exe.25d0000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
2.2.regdrv.exe.25d0000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.4.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.4.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.1.regdrv.exe.400000.0.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.1.regdrv.exe.400000.0.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.2.regdrv.exe.400000.3.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.2.regdrv.exe.400000.3.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.5.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.5.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.2.regdrv.exe.400000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.2.regdrv.exe.400000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.4.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.4.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.2.regdrv.exe.400000.3.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.2.regdrv.exe.400000.3.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.5.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.5.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.4.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.4.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.0.regdrv.exe.400000.5.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.0.regdrv.exe.400000.5.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
6.0.regdrv.exe.400000.4.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
6.0.regdrv.exe.400000.4.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.1.regdrv.exe.400000.0.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.1.regdrv.exe.400000.0.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>
3.1.regdrv.exe.400000.0.raw.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth
3.1.regdrv.exe.400000.0.raw.unpack	RAT_DarkComet	Detects DarkComet RAT	Kevin Breen <kevin@techanarchy.net>

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ORIONTELEKOM-ASRS	79SWIFT COPY,pdf-INV I086#.exe	f1df846ab638f0356f84a9fe14eaeb1cf98c17fb410ac1308c144c0683c89ed8	malicious	Browse	95.140.125.9
	23RFQ-15-0798101-1296.jar	aca07b5c2399523b768b7cafd3d33975900d50d05073974a93c0b74683aabc32	malicious	Browse	95.140.125.118
	payment advice 20_03 2018.doc	c95780a21ae219e68bc2431a6e98aa1ead481129a293b9aee739a82d80ffc668	malicious	Browse	77.105.36.181
	SWIFT COPY 02.js	23b46da625d2d17af9daf2640f05769eb9e2166b27d82b3f09f09e13d2bfd067	malicious	Browse	95.140.125.117
	Contract Cop.exe	af88f00b02c7fafa486e46001e29f1aae1205fd83ff962b9ff857293640c7332	malicious	Browse	95.140.125.81
	536ffa992-491508d-ca0354e-52f32a3-7a679a53a.doc	d5f72d16015ba479d1200f68515efb1602622b3b1bcab6dbda633e63caca82ee	malicious	Browse	93.93.196.254
	Inv 54869 - PO #4F634410.doc	e39be590fb6dfa04ae6d6720588694aea026cb4d6d68f60b56d3bcea85f13455	malicious	Browse	77.105.36.132
	SCAN_9097765.js	13b5960a44dabd990e8326bf9d675a4c335d9be6b06db81875cc2e4a2c7b9a2c	malicious	Browse	95.140.125.119
	SCAN_9097765.js	13b5960a44dabd990e8326bf9d675a4c335d9be6b06db81875cc2e4a2c7b9a2c	malicious	Browse	95.140.125.119
	atmos_weber.exe	f95938b4343d5a2c7250472f71850aacb6ef3575cdc52de5c9b86e2106a3b3eb	malicious	Browse	95.140.125.108
	04172018HSBCJSZZH_app.doc	496930937ee43a2c13fd371cdadf77dc0a4c9c6b366c0c89b95acb9b8edf63fa	malicious	Browse	79.175.102.12
	66DHL SHIPMENT INF.exe	3e81efc218937fca3b8ca1beb162bf08b12bf19f508140510c771e9e325fc567	malicious	Browse	95.140.125.82
	66DHL SHIPMENT INF.exe	3e81efc218937fca3b8ca1beb162bf08b12bf19f508140510c771e9e325fc567	malicious	Browse	95.140.125.82
	Inv 54869 - PO #4F634410.doc	e39be590fb6dfa04ae6d6720588694aea026cb4d6d68f60b56d3bcea85f13455	malicious	Browse	77.105.36.132
	35PO#ORDER$9880.exe	70c4a701c97b89afa03e1e092cc7e3b11fb4c364ce8f66103228287d24cb3d74	malicious	Browse	95.140.125.50
	SWIFT COPY 02.js	23b46da625d2d17af9daf2640f05769eb9e2166b27d82b3f09f09e13d2bfd067	malicious	Browse	95.140.125.117

Dropped Files

No context

Screenshots

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report DOC000YUT600.scr

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshots