Play interactive tour

Edit tour

Analysis Report zhAQkCQvME

Overview

General Information

Joe Sandbox Version:	28.0.0 Lapis Lazuli
Analysis ID:	997215
Start date:	13.11.2019
Start time:	19:26:48
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 15m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	zhAQkCQvME (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	6
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.bank.troj.spyw.evad.winEXE@25/7@2/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 66.9% (good quality ratio 61.7%) Quality average: 77% Quality standard deviation: 31.8%
HCA Information:	Successful, ratio: 83% Number of executed functions: 255 Number of non-executed functions: 213
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe Excluded IPs from analysis (whitelisted): 93.184.221.240 Excluded domains from analysis (whitelisted): wu.ec.azureedge.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu.wpc.apr-52dd2.edgecastdns.net, wu.azureedge.net Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. Report size getting too big, too many NtSetInformationFile calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	100	0 - 100	Report FP / FN	false	Qbot

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Contains functionality to modify the execution of threads in other processes

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Sample hooks winsock APIs (likely related to a banking trojan), analyze sample with the 'Check if internet explorer is infected by malware' cookbook

Sample is a service DLL but no service has been registered

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts1	Windows Management Instrumentation21	Registry Run Keys / Startup Folder1	Exploitation for Privilege Escalation1	Software Packing22	Network Sniffing1	System Time Discovery1	Remote File Copy2	Input Capture11	Data Encrypted11	Uncommonly Used Port1
Replication Through Removable Media	Execution through API1	Hooking21	Hooking21	Deobfuscate/Decode Files or Information1	Hooking21	Account Discovery1	Remote Services	Clipboard Data1	Exfiltration Over Other Network Medium	Remote File Copy2
Drive-by Compromise	Command-Line Interface1	Valid Accounts1	Valid Accounts1	Obfuscated Files or Information2	Input Capture11	Security Software Discovery341	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Standard Cryptographic Protocol22
Exploit Public-Facing Application	Service Execution2	Scheduled Task1	Access Token Manipulation11	Rootkit2	Credentials in Files	File and Directory Discovery1	Logon Scripts	Input Capture	Data Encrypted	Standard Non-Application Layer Protocol3
Spearphishing Link	Scheduled Task1	Modify Existing Service1	Process Injection711	Valid Accounts1	Account Manipulation	Network Sniffing1	Shared Webroot	Data Staged	Scheduled Transfer	Standard Application Layer Protocol13
Spearphishing Attachment	Graphical User Interface	New Service3	Scheduled Task1	Access Token Manipulation11	Brute Force	System Information Discovery35	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port
Spearphishing via Service	Scripting	Path Interception	New Service3	Process Injection711	Two-Factor Authentication Interception	Network Share Discovery1	Pass the Hash	Email Collection	Exfiltration Over Command and Control Channel	Uncommonly Used Port
Supply Chain Compromise	Third-party Software	Logon Scripts	Process Injection	Indicator Blocking	Bash History	Query Registry1	Remote Desktop Protocol	Clipboard Data	Exfiltration Over Alternative Protocol	Standard Application Layer Protocol
Trusted Relationship	Rundll32	DLL Search Order Hijacking	Service Registry Permissions Weakness	Process Injection	Input Prompt	Process Discovery4	Windows Admin Shares	Automated Collection	Exfiltration Over Physical Medium	Multilayer Encryption
Hardware Additions	PowerShell	Change Default File Association	Exploitation for Privilege Escalation	Scripting	Keychain	System Owner/User Discovery1	Taint Shared Content	Audio Capture		Connection Proxy
	Execution through API	File System Permissions Weakness	Valid Accounts	Indicator Removal from Tools	Private Keys	Remote System Discovery11	Replication Through Removable Media	Video Capture		Communication Through Removable Media
	Regsvr32	New Service	Bypass User Account Control	Indicator Removal on Host	Securityd Memory	System Network Configuration Discovery2	Pass the Ticket	Man in the Browser		Custom Command and Control Protocol

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus or Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.hfoah
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Joe Sandbox ML: detected

Source: zhAQkCQvME.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.hfoah
Source: zhAQkCQvME.exe	Joe Sandbox ML: detected

Source: 18.0.jkfkdm.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 12.2.explorer.exe.3f0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 17.0.jkfkdm.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 5.0.zhAQkCQvME.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 14.2.jkfkdm.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 7.0.jkfkdm.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 7.2.jkfkdm.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 2.0.jkfkdm.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 1.0.zhAQkCQvME.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 6.2.jkfkdm.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 2.2.jkfkdm.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 0.2.zhAQkCQvME.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 5.2.zhAQkCQvME.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 0.0.zhAQkCQvME.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 14.0.jkfkdm.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah
Source: 18.2.jkfkdm.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 1.2.zhAQkCQvME.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 17.2.jkfkdm.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen3
Source: 6.0.jkfkdm.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.hfoah

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_00410BA0 NetUserEnum,LookupAccountNameW,LookupAccountNameW,Sleep,NetApiBufferFree,		0_2_00410BA0
Source: C:\Windows\explorer.exe	Code function: 12_2_00400BA0 NetUserEnum,LookupAccountNameW,LookupAccountNameW,Sleep,NetApiBufferFree,		12_2_00400BA0

Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View	JA3 fingerprint: eb88d0b3e1961a0562f006e5ce2a0b87

Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.225.30
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.13.33

Source: explorer.exe, 0000000C.00000002.752804516.005A3000.00000004.00000020.sdmp	String found in binary or memory: <a href="https://www.facebook.com/whoisip" target="_blank">Visit ip-adress.com on Facebook</a> equals www.facebook.com (Facebook)
Source: explorer.exe, 0000000C.00000002.752804516.005A3000.00000004.00000020.sdmp	String found in binary or memory: <aside class="share"><div class="shariff" data-button-style="standard" data-lang="en" data-services="facebook,twitter,googleplus"></div></aside><aside class="ad link no-label"> equals www.twitter.com (Twitter)
Source: explorer.exe, 0000000C.00000002.752804516.005A3000.00000004.00000020.sdmp	String found in binary or memory: <p>Your IP is the network protocol in the background that helps you communicate online using websites, sending email, chatting on Facebook, and everything else requiring an Internet connection. An IP Address is required to connect to the Internet, and IP-Adress.com gives you the tools that can help you.</p> equals www.facebook.com (Facebook)
Source: taskhost.exe, 00000013.00000000.541041949.01510000.00000004.00000001.sdmp	String found in binary or memory: GMSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365!$ equals www.hotmail.com (Hotmail)
Source: dwm.exe, 00000015.00000002.761332062.01B70000.00000004.00000040.sdmp	String found in binary or memory: NTUSER.DAT<%02X>AVAST Softwarei3w1explorer.exef1DELETE.aniEND/ url=[%s] user=[%s] pass=[%s]LEFT10AvastObtainUserAgentString.lnkPR_SetError000comet.yahoo.com;.hiro.tv;safebrowsing.google.com;geo.query.yahoo.com;googleusercontent.com;salesforce.com;officeapps.live.com;storage.live.com;messenger.live.com;.twimg.com;api.skype.com;mail.google.com;.bing.com;playtoga.com;.mozilla.com;.mozilla.org;hotbar.com;lphbs.com;contacts.msn.com;search.msn.com;clients.mindbodyonline.com;loyaltyconnect.ihg.com;.amazonaws.com;audatexsolutions.com;mail.services.live.com;etsy.com;.king.com;phantomefx.com;facebook.com;.gator.com;doubleclick.;zango.com;180solutions.com;wildtangent.com;webhancer.com;tbreport.bellsouth.net;spamblockerutility.com;internet-optimizer.com;.adworldmedia.com;seekmo.com;r777r.info;sipuku.com;eorezo.com;newasp.com.cn;wpzkq.com;radialpoint.com;owlforce.com;.microsoft.com;localhost;127.0.0.1;securestudies.com;farmville.com;mybrowserbar.com;auditude.com;digitalmediacommunications.com;mapquest.com;kixeye.com;mysh
Source: dwm.exe, 00000015.00000002.761332062.01B70000.00000004.00000040.sdmp	String found in binary or memory: comet.yahoo.com;.hiro.tv;safebrowsing.google.com;geo.query.yahoo.com;googleusercontent.com;salesforce.com;officeapps.live.com;storage.live.com;messenger.live.com;.twimg.com;api.skype.com;mail.google.com;.bing.com;playtoga.com;.mozilla.com;.mozilla.org;hotbar.com;lphbs.com;contacts.msn.com;search.msn.com;clients.mindbodyonline.com;loyaltyconnect.ihg.com;.amazonaws.com;audatexsolutions.com;mail.services.live.com;etsy.com;.king.com;phantomefx.com;facebook.com;.gator.com;doubleclick.;zango.com;180solutions.com;wildtangent.com;webhancer.com;tbreport.bellsouth.net;spamblockerutility.com;internet-optimizer.com;.adworldmedia.com;seekmo.com;r777r.info;sipuku.com;eorezo.com;newasp.com.cn;wpzkq.com;radialpoint.com;owlforce.com;.microsoft.com;localhost;127.0.0.1;securestudies.com;farmville.com;mybrowserbar.com;auditude.com;digitalmediacommunications.com;mapquest.com;kixeye.com;myshopres.com;conduit-services.com;zynga.com;.5min.com;netflix.com;tubemogul.com;youtube.com;brightcove.com;mochibot.com;fwmrm.net;mendeley.com equ
Source: zhAQkCQvME.exe, 00000000.00000002.470959957.015D0000.00000004.00000040.sdmp, zhAQkCQvME.exe, 00000001.00000002.452348450.016D0000.00000004.00000040.sdmp, jkfkdm.exe, 00000002.00000002.487446283.01550000.00000004.00000040.sdmp, zhAQkCQvME.exe, 00000005.00000002.485333119.00AA0000.00000004.00000040.sdmp, jkfkdm.exe, 00000006.00000002.478496840.01600000.00000004.00000040.sdmp, jkfkdm.exe, 00000007.00000002.493272674.01630000.00000004.00000040.sdmp, explorer.exe, 0000000C.00000002.753873444.018E0000.00000004.00000040.sdmp, jkfkdm.exe, 0000000E.00000002.491326133.015A0000.00000004.00000040.sdmp, jkfkdm.exe, 00000011.00000002.518700844.016D0000.00000004.00000040.sdmp, jkfkdm.exe, 00000012.00000002.517136665.01490000.00000004.00000040.sdmp, taskhost.exe, 00000013.00000002.759522715.028D0000.00000004.00000040.sdmp, dwm.exe, 00000015.00000002.761332062.01B70000.00000004.00000040.sdmp	String found in binary or memory: facebook.com/login equals www.facebook.com (Facebook)
Source: explorer.exe, 0000000C.00000002.752929952.00646000.00000004.00000020.sdmp	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: explorer.exe, 0000000C.00000002.752929952.00646000.00000004.00000020.sdmp	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: explorer.exe, 0000000C.00000002.752929952.00646000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown	Network traffic detected: HTTP traffic on port 49160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49158
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49160
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: 0000000C.00000002.752639572.003F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot Payload Author: kevoreilly
Source: 0000000C.00000002.753280657.01500000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot Payload Author: kevoreilly
Source: 12.2.explorer.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 12.2.explorer.exe.3f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 14.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 12.2.explorer.exe.1500000.3.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 7.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 6.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 2.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 0.2.zhAQkCQvME.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 12.2.explorer.exe.1500000.3.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 5.2.zhAQkCQvME.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 18.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 1.2.zhAQkCQvME.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly
Source: 17.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot Payload Author: kevoreilly

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_0040C370 GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,GetCurrentProcess,NtDuplicateObject,CloseHandle,_wcscmp,CloseHandle,CloseHandle,CloseHandle,StrStrIW,CloseHandle,CloseHandle,	0_2_0040C370
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015D940B NtQueryInformationThread,GetCurrentProcessId,NtResumeThread,	19_2_015D940B
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013B940B NtQueryInformationThread,GetCurrentProcessId,NtResumeThread,	21_2_013B940B
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011D940B NtQueryInformationThread,GetCurrentProcessId,NtResumeThread,	24_2_011D940B
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011B940B NtQueryInformationThread,GetCurrentProcessId,NtResumeThread,	25_2_011B940B

Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{D72D0A04-1F72-49F1-8077-3C73EF051907}
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{B9EC2CD2-EC20-4B7F-99E4-9EB20CB3037F}
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Mutant created: \BaseNamedObjects\Global\{D72D0A04-1F72-49F1-8077-3C73EF051907}
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Mutant created: \Sessions\1\BaseNamedObjects\wuinmr

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_00409C00	0_2_00409C00
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_0040A090	0_2_0040A090
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_0040F770	0_2_0040F770
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_004031F0	0_2_004031F0
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_0041280F	0_2_0041280F
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_00402690	0_2_00402690
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_0040CEA0	0_2_0040CEA0
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_004088B0	0_2_004088B0
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_00413120	0_2_00413120
Source: C:\Windows\explorer.exe	Code function: 12_2_003F2690	12_2_003F2690
Source: C:\Windows\explorer.exe	Code function: 12_2_003F9C00	12_2_003F9C00
Source: C:\Windows\explorer.exe	Code function: 12_2_0040280F	12_2_0040280F
Source: C:\Windows\explorer.exe	Code function: 12_2_003F88B0	12_2_003F88B0
Source: C:\Windows\explorer.exe	Code function: 12_2_003FA090	12_2_003FA090
Source: C:\Windows\explorer.exe	Code function: 12_2_00403120	12_2_00403120
Source: C:\Windows\explorer.exe	Code function: 12_2_003F31F0	12_2_003F31F0
Source: C:\Windows\explorer.exe	Code function: 12_2_003FCEA0	12_2_003FCEA0
Source: C:\Windows\explorer.exe	Code function: 12_2_003FF770	12_2_003FF770
Source: C:\Windows\explorer.exe	Code function: 12_2_0151EA50	12_2_0151EA50
Source: C:\Windows\explorer.exe	Code function: 12_2_0151E5C0	12_2_0151E5C0
Source: C:\Windows\explorer.exe	Code function: 12_2_01511112	12_2_01511112
Source: C:\Windows\explorer.exe	Code function: 12_2_015131DC	12_2_015131DC
Source: C:\Windows\explorer.exe	Code function: 12_2_015269AF	12_2_015269AF
Source: C:\Windows\explorer.exe	Code function: 12_2_01511A1B	12_2_01511A1B
Source: C:\Windows\explorer.exe	Code function: 12_2_01512AD6	12_2_01512AD6
Source: C:\Windows\explorer.exe	Code function: 12_2_015272C0	12_2_015272C0
Source: C:\Windows\explorer.exe	Code function: 12_2_01515530	12_2_01515530
Source: C:\Windows\explorer.exe	Code function: 12_2_01511533	12_2_01511533
Source: C:\Windows\explorer.exe	Code function: 12_2_01523C50	12_2_01523C50
Source: C:\Windows\explorer.exe	Code function: 12_2_01520650	12_2_01520650
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015E9EC0	19_2_015E9EC0
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015E7100	19_2_015E7100
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015E51D0	19_2_015E51D0
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015EB580	19_2_015EB580
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015E4C00	19_2_015E4C00
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015D1430	19_2_015D1430
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015E2382	19_2_015E2382
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015E1AD0	19_2_015E1AD0
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015E9AF0	19_2_015E9AF0
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013C9EC0	21_2_013C9EC0
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013C7100	21_2_013C7100
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013C51D0	21_2_013C51D0
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013DA1CF	21_2_013DA1CF
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013DA354	21_2_013DA354
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013DA352	21_2_013DA352
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013C2382	21_2_013C2382
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013C9AF0	21_2_013C9AF0
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013C1AD0	21_2_013C1AD0
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013CB580	21_2_013CB580
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013B1430	21_2_013B1430
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013C4C00	21_2_013C4C00
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011E9EC0	24_2_011E9EC0
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011E7100	24_2_011E7100
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011E51D0	24_2_011E51D0
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011FA1CF	24_2_011FA1CF
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011FA354	24_2_011FA354
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011FA352	24_2_011FA352
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011E2382	24_2_011E2382
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011E1AD0	24_2_011E1AD0
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011E9AF0	24_2_011E9AF0
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011EB580	24_2_011EB580
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011E4C00	24_2_011E4C00
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011D1430	24_2_011D1430
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011C9EC0	25_2_011C9EC0
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011C7100	25_2_011C7100
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011C51D0	25_2_011C51D0
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011DA1CF	25_2_011DA1CF
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011DA354	25_2_011DA354
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011DA352	25_2_011DA352
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011C2382	25_2_011C2382
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011C1AD0	25_2_011C1AD0
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011C9AF0	25_2_011C9AF0
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011CB580	25_2_011CB580
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011C4C00	25_2_011C4C00
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011B1430	25_2_011B1430

Source: zhAQkCQvME.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: zhAQkCQvME.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: zhAQkCQvME.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: zhAQkCQvME.exe, 00000000.00000002.470874320.006C3000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamerjrwer.exev vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000000.00000002.470874320.006C3000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamerjrwer.exe vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000000.00000002.470376366.002B0000.00000008.00000001.sdmp	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000001.00000000.447916030.0049E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamerjrwer.exe vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000001.00000002.451933719.00170000.00000008.00000001.sdmp	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000005.00000002.489044820.01260000.00000008.00000001.sdmp	Binary or memory string: originalfilename vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000005.00000002.489044820.01260000.00000008.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000005.00000002.482849544.002B0000.00000008.00000001.sdmp	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000005.00000000.472415467.0049E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamerjrwer.exe vs zhAQkCQvME.exe
Source: zhAQkCQvME.exe, 00000005.00000002.485204244.00A60000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs zhAQkCQvME.exe

Source: 00000005.00000002.488530565.00EF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 0000000C.00000003.535349218.01779000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 0000000C.00000002.752639572.003F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 00000000.00000002.470976903.015F7000.00000004.00000040.sdmp, type: MEMORY	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 00000000.00000002.472365977.01B20000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 0000000C.00000002.753280657.01500000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 0000000C.00000002.753280657.01500000.00000040.00000001.sdmp, type: MEMORY	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 00000005.00000002.485394157.00AC7000.00000004.00000040.sdmp, type: MEMORY	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 12.2.explorer.exe.3f0000.0.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 12.2.explorer.exe.3f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 14.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 12.2.explorer.exe.1500000.3.unpack, type: UNPACKEDPE	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 12.2.explorer.exe.1500000.3.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 7.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 6.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 2.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 0.2.zhAQkCQvME.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 12.2.explorer.exe.1500000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Datper author = JPCERT/CC Incident Response Group, description = detect Datper in memory, rule_usage = memory scan, reference = https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Source: 12.2.explorer.exe.1500000.3.raw.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 5.2.zhAQkCQvME.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 18.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 1.2.zhAQkCQvME.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload
Source: 17.2.jkfkdm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: QakBot author = kevoreilly, description = QakBot Payload, cape_type = QakBot Payload

Source: zhAQkCQvME.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_SECURITY size: 0x4 address: 0x0
Source: jkfkdm.exe.0.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_SECURITY size: 0x4 address: 0x0

Source: zhAQkCQvME.exe	Static PE information: Section: CODE ZLIB complexity 0.999666291739
Source: jkfkdm.exe.0.dr	Static PE information: Section: CODE ZLIB complexity 0.999666291739

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: 0_2_00401420 StartServiceCtrlDispatcherA,		0_2_00401420
Source: C:\Windows\explorer.exe	Code function: 12_2_003F1420 StartServiceCtrlDispatcherA,		12_2_003F1420

Source: C:\Windows\System32\schtasks.exe	Console Write: ........a..v..0.....d...`...D....f..........................`.L...l.<.n.0.n.......!...L.........0.!.........rp....!.G..u			Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Console Write: ........a..v..0.........$...L...,n..........................`.....&.x.....(...................................w.....G..u			Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report zhAQkCQvME

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Cryptography:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Signature Similarity

Similar Samples

Behavior Graph

Simulations

Behavior and APIs

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Process created: C:\Windows\explorer.exe			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\zhAQkCQvME.exe 'C:\Users\user\Desktop\zhAQkCQvME.exe'
Source: unknown	Process created: C:\Users\user\Desktop\zhAQkCQvME.exe C:\Users\user\Desktop\zhAQkCQvME.exe /C
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe
Source: unknown	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn ahizzkkevf /tr '\'C:\Users\user\Desktop\zhAQkCQvME.exe\' /I ahizzkkevf' /SC ONCE /Z /ST 19:29 /ET 19:41
Source: unknown	Process created: C:\Users\user\Desktop\zhAQkCQvME.exe C:\Users\user\Desktop\zhAQkCQvME.exe /I ahizzkkevf
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe /C
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ping.exe -n 6 127.0.0.1 & type 'C:\Windows\System32\calc.exe' > 'C:\Users\user\Desktop\zhAQkCQvME.exe'
Source: unknown	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\system32\schtasks.exe' /DELETE /F /TN ahizzkkevf
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\System32\PING.EXE ping.exe -n 6 127.0.0.1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe /C
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe 'C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe /C
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process created: C:\Users\user\Desktop\zhAQkCQvME.exe C:\Users\user\Desktop\zhAQkCQvME.exe /C	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn ahizzkkevf /tr '\'C:\Users\user\Desktop\zhAQkCQvME.exe\' /I ahizzkkevf' /SC ONCE /Z /ST 19:29 /ET 19:41	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe /C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ping.exe -n 6 127.0.0.1 & type 'C:\Windows\System32\calc.exe' > 'C:\Users\user\Desktop\zhAQkCQvME.exe'	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\system32\schtasks.exe' /DELETE /F /TN ahizzkkevf	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe /C	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping.exe -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe /C	Jump to behavior

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Unpacked PE file: 0.2.zhAQkCQvME.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Unpacked PE file: 1.2.zhAQkCQvME.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Unpacked PE file: 2.2.jkfkdm.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Unpacked PE file: 5.2.zhAQkCQvME.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Unpacked PE file: 6.2.jkfkdm.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Unpacked PE file: 7.2.jkfkdm.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Unpacked PE file: 14.2.jkfkdm.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Unpacked PE file: 17.2.jkfkdm.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe	Unpacked PE file: 18.2.jkfkdm.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;CODE:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: jkfkdm.exe.0.dr	Static PE information: real checksum: 0x36016 should be: 0xb495e
Source: zhAQkCQvME.exe	Static PE information: real checksum: 0x36016 should be: 0xb495e

Source: C:\Windows\explorer.exe	Code function: 12_2_0040ACE6 push ebx; ret	12_2_0040ACE7
Source: C:\Windows\explorer.exe	Code function: 12_2_0040AA34 push cs; iretd	12_2_0040AB0A
Source: C:\Windows\explorer.exe	Code function: 12_2_0040AB36 push cs; iretd	12_2_0040AB0A
Source: C:\Windows\explorer.exe	Code function: 12_2_0153212C push cs; iretd	12_2_01532202
Source: C:\Windows\explorer.exe	Code function: 12_2_0152B043 push 0000006Ah; retf	12_2_0152B11C
Source: C:\Windows\explorer.exe	Code function: 12_2_0152B0AB push 0000006Ah; retf	12_2_0152B11C
Source: C:\Windows\explorer.exe	Code function: 12_2_0152B0AD push 0000006Ah; retf	12_2_0152B11C
Source: C:\Windows\explorer.exe	Code function: 12_2_015323DE push ebx; ret	12_2_015323DF
Source: C:\Windows\explorer.exe	Code function: 12_2_01535260 push esp; ret	12_2_01535264
Source: C:\Windows\explorer.exe	Code function: 12_2_0153222E push cs; iretd	12_2_01532202
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015F3D7E push ebx; ret	19_2_015F3D7F
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015F3BCE push cs; iretd	19_2_015F3BA2
Source: C:\Windows\System32\taskhost.exe	Code function: 19_2_015F3ACC push cs; iretd	19_2_015F3BA2
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013D3BCE push cs; iretd	21_2_013D3BA2
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013D3ACC push cs; iretd	21_2_013D3BA2
Source: C:\Windows\System32\dwm.exe	Code function: 21_2_013D3D7E push ebx; ret	21_2_013D3D7F
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011F3BCE push cs; iretd	24_2_011F3BA2
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011F3ACC push cs; iretd	24_2_011F3BA2
Source: C:\Windows\System32\conhost.exe	Code function: 24_2_011F3D7E push ebx; ret	24_2_011F3D7F
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011D3BCE push cs; iretd	25_2_011D3BA2
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011D3ACC push cs; iretd	25_2_011D3BA2
Source: C:\Windows\System32\notepad.exe	Code function: 25_2_011D3D7E push ebx; ret	25_2_011D3D7F

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\Desktop\zhAQkCQvME.exe			Jump to dropped file
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Eacrrvkown\jkfkdm.exe			Jump to dropped file

Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tjmptzibr			Jump to behavior
Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tjmptzibr			Jump to behavior

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Code function: GetModuleHandleA,GetModuleFileNameA,StrStrIA,		0_2_0040B120
Source: C:\Windows\explorer.exe	Code function: GetModuleHandleA,GetModuleFileNameA,StrStrIA,		12_2_003FB120

Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Users\user\Desktop\zhAQkCQvME.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep