resource	yara_rule
behavioral8/memory/4080-190-0x000000000041607E-mapping.dmp	family_redline
behavioral8/memory/4080-189-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

pid	Process
1456	Crack.exe
3992	ABCbrow.exe
2812	jg6_6asg.exe
1728	gaoou.exe
1960	jfiag3g_gg.exe
3584	jfiag3g_gg.exe
5052	jfiag3g_gg.exe
948	jfiag3g_gg.exe

resource	yara_rule
behavioral8/files/0x000100000001ab5b-229.dat	upx
behavioral8/files/0x000100000001ab5b-230.dat	upx
behavioral8/files/0x000600000001ab50-234.dat	upx
behavioral8/files/0x000600000001ab50-235.dat	upx
behavioral8/files/0x000a000000000685-262.dat	upx
behavioral8/files/0x000a000000000685-263.dat	upx
behavioral8/files/0x0010000000000687-266.dat	upx
behavioral8/files/0x0010000000000687-267.dat	upx

resource	yara_rule
behavioral8/files/0x000100000001ab49-195.dat	vmprotect
behavioral8/files/0x000100000001ab49-194.dat	vmprotect
behavioral8/memory/2812-199-0x0000000000400000-0x00000000005DB000-memory.dmp	vmprotect

description	pid	Process	procid_target
PID 752 set thread context of 1112	752	svchost.exe	81
PID 3992 set thread context of 4080	3992	ABCbrow.exe	82

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe

pid	Process
2816	rUNdlL32.eXe
2816	rUNdlL32.eXe
752	svchost.exe
752	svchost.exe
3584	jfiag3g_gg.exe
3584	jfiag3g_gg.exe
4080	AddInProcess32.exe
5052	jfiag3g_gg.exe
5052	jfiag3g_gg.exe
948	jfiag3g_gg.exe
948	jfiag3g_gg.exe

description	pid	Process
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	752	svchost.exe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	3992	ABCbrow.exe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeDebugPrivilege	2816	rUNdlL32.eXe
Token: SeManageVolumePrivilege	2812	jg6_6asg.exe
Token: SeManageVolumePrivilege	2812	jg6_6asg.exe
Token: SeManageVolumePrivilege	2812	jg6_6asg.exe
Token: SeManageVolumePrivilege	2812	jg6_6asg.exe
Token: SeManageVolumePrivilege	2812	jg6_6asg.exe
Token: SeDebugPrivilege	4080	AddInProcess32.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeDebugPrivilege	1112	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2780	svchost.exe
Token: SeIncreaseQuotaPrivilege	2780	svchost.exe
Token: SeSecurityPrivilege	2780	svchost.exe
Token: SeTakeOwnershipPrivilege	2780	svchost.exe
Token: SeLoadDriverPrivilege	2780	svchost.exe
Token: SeSystemtimePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeShutdownPrivilege	2780	svchost.exe
Token: SeSystemEnvironmentPrivilege	2780	svchost.exe
Token: SeUndockPrivilege	2780	svchost.exe
Token: SeManageVolumePrivilege	2780	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2780	svchost.exe
Token: SeIncreaseQuotaPrivilege	2780	svchost.exe
Token: SeSecurityPrivilege	2780	svchost.exe
Token: SeTakeOwnershipPrivilege	2780	svchost.exe
Token: SeLoadDriverPrivilege	2780	svchost.exe
Token: SeSystemtimePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeShutdownPrivilege	2780	svchost.exe
Token: SeSystemEnvironmentPrivilege	2780	svchost.exe
Token: SeUndockPrivilege	2780	svchost.exe
Token: SeManageVolumePrivilege	2780	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2780	svchost.exe
Token: SeIncreaseQuotaPrivilege	2780	svchost.exe
Token: SeSecurityPrivilege	2780	svchost.exe
Token: SeTakeOwnershipPrivilege	2780	svchost.exe
Token: SeLoadDriverPrivilege	2780	svchost.exe
Token: SeSystemtimePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe

description	pid	Process	procid_target
PID 1892 wrote to memory of 1456	1892	keygen-step-4.exe	76
PID 1892 wrote to memory of 1456	1892	keygen-step-4.exe	76
PID 1892 wrote to memory of 1456	1892	keygen-step-4.exe	76
PID 1456 wrote to memory of 2816	1456	Crack.exe	79
PID 1456 wrote to memory of 2816	1456	Crack.exe	79
PID 1456 wrote to memory of 2816	1456	Crack.exe	79
PID 1892 wrote to memory of 3992	1892	keygen-step-4.exe	80
PID 1892 wrote to memory of 3992	1892	keygen-step-4.exe	80
PID 1892 wrote to memory of 3992	1892	keygen-step-4.exe	80
PID 2816 wrote to memory of 752	2816	rUNdlL32.eXe	70
PID 2816 wrote to memory of 2696	2816	rUNdlL32.eXe	41
PID 752 wrote to memory of 1112	752	svchost.exe	81
PID 752 wrote to memory of 1112	752	svchost.exe	81
PID 752 wrote to memory of 1112	752	svchost.exe	81
PID 2816 wrote to memory of 1008	2816	rUNdlL32.eXe	62
PID 2816 wrote to memory of 2528	2816	rUNdlL32.eXe	44
PID 2816 wrote to memory of 2536	2816	rUNdlL32.eXe	43
PID 2816 wrote to memory of 1140	2816	rUNdlL32.eXe	11
PID 2816 wrote to memory of 1084	2816	rUNdlL32.eXe	10
PID 2816 wrote to memory of 1420	2816	rUNdlL32.eXe	14
PID 2816 wrote to memory of 1948	2816	rUNdlL32.eXe	50
PID 2816 wrote to memory of 1176	2816	rUNdlL32.eXe	56
PID 2816 wrote to memory of 1412	2816	rUNdlL32.eXe	15
PID 2816 wrote to memory of 2780	2816	rUNdlL32.eXe	27
PID 2816 wrote to memory of 2800	2816	rUNdlL32.eXe	26
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 3992 wrote to memory of 4080	3992	ABCbrow.exe	82
PID 1892 wrote to memory of 2812	1892	keygen-step-4.exe	83
PID 1892 wrote to memory of 2812	1892	keygen-step-4.exe	83
PID 1892 wrote to memory of 2812	1892	keygen-step-4.exe	83
PID 1892 wrote to memory of 1728	1892	keygen-step-4.exe	84
PID 1892 wrote to memory of 1728	1892	keygen-step-4.exe	84
PID 1892 wrote to memory of 1728	1892	keygen-step-4.exe	84
PID 1728 wrote to memory of 1960	1728	gaoou.exe	85
PID 1728 wrote to memory of 1960	1728	gaoou.exe	85
PID 1728 wrote to memory of 1960	1728	gaoou.exe	85
PID 1728 wrote to memory of 3584	1728	gaoou.exe	89
PID 1728 wrote to memory of 3584	1728	gaoou.exe	89
PID 1728 wrote to memory of 3584	1728	gaoou.exe	89
PID 1112 wrote to memory of 2696	1112	svchost.exe	41
PID 1112 wrote to memory of 1008	1112	svchost.exe	62
PID 1112 wrote to memory of 2528	1112	svchost.exe	44
PID 1112 wrote to memory of 2536	1112	svchost.exe	43
PID 1112 wrote to memory of 1140	1112	svchost.exe	11
PID 1112 wrote to memory of 1084	1112	svchost.exe	10
PID 1112 wrote to memory of 1420	1112	svchost.exe	14
PID 1112 wrote to memory of 1948	1112	svchost.exe	50
PID 1112 wrote to memory of 1176	1112	svchost.exe	56
PID 1112 wrote to memory of 1412	1112	svchost.exe	15
PID 1112 wrote to memory of 2780	1112	svchost.exe	27
PID 1112 wrote to memory of 2800	1112	svchost.exe	26
PID 1728 wrote to memory of 5052	1728	gaoou.exe	93
PID 1728 wrote to memory of 5052	1728	gaoou.exe	93
PID 1728 wrote to memory of 5052	1728	gaoou.exe	93
PID 1728 wrote to memory of 948	1728	gaoou.exe	94
PID 1728 wrote to memory of 948	1728	gaoou.exe	94
PID 1728 wrote to memory of 948	1728	gaoou.exe	94

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request