Edit tour

Windows Analysis Report
123.scr.exe

Overview

General Information

Sample name:	123.scr.exe
Analysis ID:	1361824
MD5:	2cd8134f58cdbda71373f5ea79d5a422
SHA1:	f30cc8c8056e6943a4114e557615552f16cb8e2f
SHA256:	7e00639b962e167ab8463fa871f8fe12f6e38166a497d7ed8cf3a2370053d1f0
Tags:	exeUKR
Infos:

Detection

Rags Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Rags Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

123.scr.exe (PID: 6840 cmdline: C:\Users\user\Desktop\123.scr.exe MD5: 2CD8134F58CDBDA71373F5EA79D5A422)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x12094:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x126ac:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x109dc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: 123.scr.exe PID: 6840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 123.scr.exe PID: 6840	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Process Memory Space: 123.scr.exe PID: 6840	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x36ad6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x36b27:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x48fcb:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x4905e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 123.scr.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 123.scr.exe	ReversingLabs: Detection: 51%
Source: 123.scr.exe	Virustotal: Detection: 51%			Perma Link

Machine Learning detection for sample

Source: 123.scr.exe

Joe Sandbox ML: detected

Source: 123.scr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.73.97:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.71:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: 123.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: 123.scr.exe, 00000000.00000002.1686858017.000001DE90272000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9031A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9031A000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.21.73.97 104.21.73.97

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: freegeoip.app

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Dec 2023 00:41:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAge: 21647Cache-Control: public,max-age=0,must-revalidateCache-Status: "Netlify Edge"; hitVary: Accept-EncodingX-Nf-Request-Id: 01HHJWA1BAJX35GM5Y24XTNFQJCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xq%2FWqt8caz1AaVBhF6K5%2Bj6%2FLdXGBlzOJ3sLpNL2DQODjVELF611Dso8pASHSSBOXbBjr6pG1YvHk%2FwjWSov8Dqj4HlO6%2FW7MBZW6j%2BH6qM7x0jhxxYT343jCe2M"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8352660eb98a748a-MIAalt-svc: h3=":443"; ma=86400

Source: cert9.db.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.0.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 123.scr.exe, 00000000.00000002.1686332899.000001DE8E6C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: cert9.db.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.0.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE90286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://freegeoip.app
Source: 123.scr.exe, 00000000.00000002.1686332899.000001DE8E6C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.micQ
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE902BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipbase.com
Source: cert9.db.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.0.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE901F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cert9.db.0.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.0.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE902A2000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1686858017.000001DE9031A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.vimeworld.ru/user/name/
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/webhooks/1184504729359896607/fPAMX9PDaXX6cd_-7EdUwUPRgvGLKrETMXz361gwk0y1
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9031A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE90262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE902AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE902A6000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1686858017.000001DE90286000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1686858017.000001DE902AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com/xml/
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/
Source: tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA009A000.00000004.00000800.00020000.00000000.sdmp, tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 123.scr.exe, 00000000.00000002.1690460808.000001DEA009A000.00000004.00000800.00020000.00000000.sdmp, tmp4714.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: unknown	HTTPS traffic detected: 104.21.73.97:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.71:443 -> 192.168.2.4:49730 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: 123.scr.exe PID: 6840, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB4F7F	0_2_00007FFD9BAB4F7F
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB07B8	0_2_00007FFD9BAB07B8
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB0568	0_2_00007FFD9BAB0568
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB089D	0_2_00007FFD9BAB089D
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB9C34	0_2_00007FFD9BAB9C34
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BABDB36	0_2_00007FFD9BABDB36
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB0730	0_2_00007FFD9BAB0730
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB8A10	0_2_00007FFD9BAB8A10
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BABB1FB	0_2_00007FFD9BABB1FB
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BAB0500	0_2_00007FFD9BAB0500
Source: C:\Users\user\Desktop\123.scr.exe	Code function: 0_2_00007FFD9BABDC7F	0_2_00007FFD9BABDC7F

Source: 123.scr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: 123.scr.exe PID: 6840, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: 123.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal92.troj.spyw.evad.winEXE@1/14@2/2

Source: C:\Users\user\Desktop\123.scr.exe

File created: C:\Users\user\AppData\Roaming\44

Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4714.tmp

Jump to behavior

Source: 123.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 123.scr.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\123.scr.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\123.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\123.scr.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE901F2000.00000004.00000800.00020000.00000000.sdmp, tmp47D2.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 123.scr.exe	ReversingLabs: Detection: 51%
Source: 123.scr.exe	Virustotal: Detection: 51%

Source: C:\Users\user\Desktop\123.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 123.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 123.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: 123.scr.exe, 00000000.00000002.1686858017.000001DE90272000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9031A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9031A000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\123.scr.exe

Code function: 0_2_00007FFD9BAB73FA push eax; iretd

0_2_00007FFD9BAB74AD

Source: initial sample

Static PE information: section name: .text entropy: 7.989676579902905

Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\123.scr.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599308	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe	Window / User API: threadDelayed 2160			Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Window / User API: threadDelayed 379			Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599308s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -598704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -598579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6332	Thread sleep time: -598454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 7120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe TID: 6912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\123.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\123.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599308	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 123.scr.exe, 00000000.00000002.1692233734.000001DEA89D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllXz"
Source: 123.scr.exe, 00000000.00000002.1692233734.000001DEA89D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 123.scr.exe, 00000000.00000002.1692233734.000001DEA89D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwarePS7ON1OFWin32_VideoControllerPN_KWUCDVideoController120060621000000.000000-00044967925display.infMSBDA6EU8CVZ1PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemuser-PC1280 x 1024 x 4294967296 colorsS9ODUAU9

Source: C:\Users\user\Desktop\123.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe

Queries volume information: C:\Users\user\Desktop\123.scr.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\123.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Rags Stealer

Source: Yara match	File source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 123.scr.exe PID: 6840, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\123.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\123.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\123.scr.exe

File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Jump to behavior

Source: Yara match	File source: 00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 123.scr.exe PID: 6840, type: MEMORYSTR

Remote Access Functionality

Yara detected Rags Stealer

Source: Yara match	File source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 123.scr.exe PID: 6840, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	121 Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	4 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
123.scr.exe	51%	ReversingLabs	Win32.Trojan.Generic
123.scr.exe	51%	Virustotal		Browse
123.scr.exe	100%	Avira	HEUR/AGEN.1314436
123.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
ipbase.com	1%	Virustotal		Browse
freegeoip.app	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
http://crl.v	0%	URL Reputation	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://go.micQ	0%	Avira URL Cloud	safe
https://freegeoip.app	1%	Virustotal		Browse
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Virustotal		Browse
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/	0%	Avira URL Cloud	safe
https://freegeoip.app	0%	Avira URL Cloud	safe
http://ipbase.com	0%	Avira URL Cloud	safe
https://ipbase.com/xml/	0%	Avira URL Cloud	safe
https://ipbase.com	0%	Avira URL Cloud	safe
http://ipbase.com	1%	Virustotal		Browse
http://freegeoip.app	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/	1%	Virustotal		Browse
https://ipbase.com	1%	Virustotal		Browse
http://freegeoip.app	1%	Virustotal		Browse
https://ipbase.com/xml/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipbase.com	172.67.209.71	true	false	1%, Virustotal, Browse	unknown
freegeoip.app	104.21.73.97	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://freegeoip.app/xml/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipbase.com/xml/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	tmp4714.tmp.tmpdb.0.dr	false		high
https://duckduckgo.com/ac/?q=	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
http://go.micQ	123.scr.exe, 00000000.00000002.1686332899.000001DE8E6C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discordapp.com/api/webhooks/1184504729359896607/fPAMX9PDaXX6cd_-7EdUwUPRgvGLKrETMXz361gwk0y1	123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
https://freegeoip.app	123.scr.exe, 00000000.00000002.1686858017.000001DE90262000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	cert9.db.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	cert9.db.0.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp4714.tmp.tmpdb.0.dr	false		high
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	123.scr.exe, 00000000.00000002.1686858017.000001DE902A2000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1686858017.000001DE9031A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
http://ipbase.com	123.scr.exe, 00000000.00000002.1686858017.000001DE902BF000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	cert9.db.0.dr	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	cert9.db.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	cert9.db.0.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/	123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.vimeworld.ru/user/name/	123.scr.exe, 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	tmp4714.tmp.tmpdb.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	123.scr.exe, 00000000.00000002.1686858017.000001DE901F7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.v	123.scr.exe, 00000000.00000002.1686332899.000001DE8E6C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	123.scr.exe, 00000000.00000002.1690460808.000001DEA0079000.00000004.00000800.00020000.00000000.sdmp, 123.scr.exe, 00000000.00000002.1690460808.000001DEA0593000.00000004.00000800.00020000.00000000.sdmp, tmp47E3.tmp.dat.0.dr, tmp4754.tmp.dat.0.dr	false		high
https://ipbase.com	123.scr.exe, 00000000.00000002.1686858017.000001DE902AA000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://freegeoip.app	123.scr.exe, 00000000.00000002.1686858017.000001DE90286000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.209.71	ipbase.com	United States		13335	CLOUDFLARENETUS	false
104.21.73.97	freegeoip.app	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1361824
Start date and time:	2023-12-14 01:40:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	123.scr.exe
Detection:	MAL
Classification:	mal92.troj.spyw.evad.winEXE@1/14@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:40:58	API Interceptor	15x Sleep call for process: 123.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.209.71	123.scr.exe	Get hash	malicious	Rags Stealer	Browse
	SecuriteInfo.com.FileRepMalware.dll	Get hash	malicious	Unknown	Browse
	case (426).xls	Get hash	malicious	Unknown	Browse
	case (61).xls	Get hash	malicious	Unknown	Browse
104.21.73.97	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse
	SPYGAME.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse
	gjqYWrWZfb.exe	Get hash	malicious	Snake Keylogger	Browse
	UNKnyg3t3D.exe	Get hash	malicious	Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipbase.com	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.209.71
	RP.sfx.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.85.189
	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.85.189
	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse	104.21.28.190
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	75.2.60.5
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	75.2.60.5
	SPYGAME.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	75.2.60.5
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	TwB13kUEGN.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	w5gL8sZU6z.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	k2Bg5AlSk1.exe	Get hash	malicious	MassLogger RAT, Matiex, Snake Keylogger	Browse	75.2.60.5
	vYT3XBi8du.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	CJCxcYxjhF.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	g95CmPy67V.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	nesbiPpHpN.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	M6VkStAYfV.exe	Get hash	malicious	Snake Keylogger	Browse	99.83.231.61
	2yecaxS2wK.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
	058J3H4iEy.exe	Get hash	malicious	Snake Keylogger	Browse	75.2.60.5
freegeoip.app	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.160.84
	RP.sfx.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	172.67.160.84
	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.73.97
	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse	172.67.160.84
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.160.84
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.73.97
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	104.21.73.97
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	172.67.160.84
	SPYGAME.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.73.97
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	TwB13kUEGN.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	w5gL8sZU6z.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	k2Bg5AlSk1.exe	Get hash	malicious	MassLogger RAT, Matiex, Snake Keylogger	Browse	188.114.97.7
	vYT3XBi8du.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	CJCxcYxjhF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	g95CmPy67V.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	nesbiPpHpN.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	M6VkStAYfV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7
	2yecaxS2wK.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	058J3H4iEy.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.7

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.160.84
	https://pub-6294fd7e4e6045d887ae1d52e7b31e5e.r2.dev/off.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://patl2.000webhostapp.com/login.html	Get hash	malicious	HTMLPhisher	Browse	104.17.162.41
	https://jbz.adw.mybluehost.me/CA/app/	Get hash	malicious	Unknown	Browse	66.235.200.147
	https://pub-543b6c8da6ec4a2dbe07e8b2dc6002c6.r2.dev/floxcc.html	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	https://steanmcommunllty.com/61666	Get hash	malicious	Unknown	Browse	172.67.199.201
	https://electric-comfortable-glitter.glitch.me/sibe.shtml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://microsoftemailloginsample.dreamclub.repl.co/	Get hash	malicious	Unknown	Browse	104.18.42.150
	https://unica.md/c/index/myaccount/	Get hash	malicious	Unknown	Browse	172.64.173.36
	https://thelinktulsa.org	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://show.zohopublic.com/publish/t9iwfc87a97110d0a4c2cabc47243b4814444	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~////rKvcsuIdVSbio-rad.ims-gmhb%E3%80%82de/amliaW5fam9zZUBiaW8tcmFkLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://nts.embluemail.com/p/cl?data=//mslogisticsgroup.com/984/flq/ZnJhbmsubWV0c2lrYXNzdXNAcHJlZGF0b3JvaWwuY29t	Get hash	malicious	HTMLPhisher	Browse	172.67.133.182
	4Bjyw1Vv.msi	Get hash	malicious	Unknown	Browse	104.21.43.193
	https://r20.rs6.net/tn.jsp?f=00131WKGyRJTPGrM7e0H-3pYeu_51xFHsGKs4ZjwUSfEQC8kSo_vg5XW5RP5TG8coK84HlqPZu8LIjsdDYi4rHGacMtn0jAsuIARihYb5QXoV2vuKRIuOdS7AQki5OZV1h5W-nIw6EoWt2snCZR66qAasdMaUtCVtD62jVdZfvlWYM0qZPsHb3kzA==&c=&ch=//800/wme/bWFuaWplaC5zY2htaWR0QG50c2NvcnAuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://docksofts.com	Get hash	malicious	Unknown	Browse	104.22.70.197
	r0105-12132023DEC.exe	Get hash	malicious	FormBook	Browse	172.67.190.116
	https://linkprotect.cudasvc.com/url?a=urlr.me/cKV8Y%23Z2FicmllbGRAY29tZm9ydHBtLmNh&c=E,1,RHmAtRtvh3Xjkp0o9U9OT03Z5NUzzlLucALp_SJJJWR1Xmh6DO7zW9jWv190uL58dEKoYea-eq8iWB29jHY4d9c12Gfz6LOW0fq6nJwuL8O5&typo=0	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://kostal.dracoon.team/public/download-shares/ts3Z9ksMzLq56lmciN7Y2FfnG4777dXm	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://u4922463.ct.sendgrid.net/ls/click?upn=EB1qBpEZOb0BeY3tFaEyZfbXNl0dzqCPs4IuBvxtn-2F8-3DBHSV_h9nYqBb8GTsRYM3XAu-2F7B3Zz9iJrBjlG6gAH4RrjXu04CxVIgslWhpFkLLOpnrDIxZdKkXtB0dsi4uCFiwXe-2BQuDcHYiOhVmiiGVX2UJrKAriQ2bhMzb3GHHCkgidjzlGWZXL8e3C2KMNQf6Q9oOiJZG5kFCMY00KCJ589z8lox3yd2Wd4fgbhfYLKnoZmDbSrIN1z12kWhP-2FNNvM47oHj6AF02MfILuyLAatTZfpYA-3D	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.160.84
	https://pub-6294fd7e4e6045d887ae1d52e7b31e5e.r2.dev/off.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://patl2.000webhostapp.com/login.html	Get hash	malicious	HTMLPhisher	Browse	104.17.162.41
	https://jbz.adw.mybluehost.me/CA/app/	Get hash	malicious	Unknown	Browse	66.235.200.147
	https://pub-543b6c8da6ec4a2dbe07e8b2dc6002c6.r2.dev/floxcc.html	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	https://steanmcommunllty.com/61666	Get hash	malicious	Unknown	Browse	172.67.199.201
	https://electric-comfortable-glitter.glitch.me/sibe.shtml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://microsoftemailloginsample.dreamclub.repl.co/	Get hash	malicious	Unknown	Browse	104.18.42.150
	https://unica.md/c/index/myaccount/	Get hash	malicious	Unknown	Browse	172.64.173.36
	https://thelinktulsa.org	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://show.zohopublic.com/publish/t9iwfc87a97110d0a4c2cabc47243b4814444	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~////rKvcsuIdVSbio-rad.ims-gmhb%E3%80%82de/amliaW5fam9zZUBiaW8tcmFkLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://nts.embluemail.com/p/cl?data=//mslogisticsgroup.com/984/flq/ZnJhbmsubWV0c2lrYXNzdXNAcHJlZGF0b3JvaWwuY29t	Get hash	malicious	HTMLPhisher	Browse	172.67.133.182
	4Bjyw1Vv.msi	Get hash	malicious	Unknown	Browse	104.21.43.193
	https://r20.rs6.net/tn.jsp?f=00131WKGyRJTPGrM7e0H-3pYeu_51xFHsGKs4ZjwUSfEQC8kSo_vg5XW5RP5TG8coK84HlqPZu8LIjsdDYi4rHGacMtn0jAsuIARihYb5QXoV2vuKRIuOdS7AQki5OZV1h5W-nIw6EoWt2snCZR66qAasdMaUtCVtD62jVdZfvlWYM0qZPsHb3kzA==&c=&ch=//800/wme/bWFuaWplaC5zY2htaWR0QG50c2NvcnAuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://docksofts.com	Get hash	malicious	Unknown	Browse	104.22.70.197
	r0105-12132023DEC.exe	Get hash	malicious	FormBook	Browse	172.67.190.116
	https://linkprotect.cudasvc.com/url?a=urlr.me/cKV8Y%23Z2FicmllbGRAY29tZm9ydHBtLmNh&c=E,1,RHmAtRtvh3Xjkp0o9U9OT03Z5NUzzlLucALp_SJJJWR1Xmh6DO7zW9jWv190uL58dEKoYea-eq8iWB29jHY4d9c12Gfz6LOW0fq6nJwuL8O5&typo=0	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://kostal.dracoon.team/public/download-shares/ts3Z9ksMzLq56lmciN7Y2FfnG4777dXm	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://u4922463.ct.sendgrid.net/ls/click?upn=EB1qBpEZOb0BeY3tFaEyZfbXNl0dzqCPs4IuBvxtn-2F8-3DBHSV_h9nYqBb8GTsRYM3XAu-2F7B3Zz9iJrBjlG6gAH4RrjXu04CxVIgslWhpFkLLOpnrDIxZdKkXtB0dsi4uCFiwXe-2BQuDcHYiOhVmiiGVX2UJrKAriQ2bhMzb3GHHCkgidjzlGWZXL8e3C2KMNQf6Q9oOiJZG5kFCMY00KCJ589z8lox3yd2Wd4fgbhfYLKnoZmDbSrIN1z12kWhP-2FNNvM47oHj6AF02MfILuyLAatTZfpYA-3D	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.209.71 104.21.73.97
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~////rKvcsuIdVSbio-rad.ims-gmhb%E3%80%82de/amliaW5fam9zZUBiaW8tcmFkLmNvbQ==	Get hash	malicious	Unknown	Browse	172.67.209.71 104.21.73.97
	https://www.iemenergy.com/	Get hash	malicious	Unknown	Browse	172.67.209.71 104.21.73.97
	https://www.valleylowvoltage.com/	Get hash	malicious	Unknown	Browse	172.67.209.71 104.21.73.97
	Product_Technical_Specification.scr.exe	Get hash	malicious	PureLog Stealer	Browse	172.67.209.71 104.21.73.97
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.209.71 104.21.73.97
	proforma_invoice.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	172.67.209.71 104.21.73.97
	https://cs.mytheresa.com/mix/c3/?tc_id=202311201201523757380094&tcs=3504&cid_vcms=6664627&ag=category&lg=2&tar=tgt&src=newsletter&cmp=mw_42_231016_category&tarea=07&csf=23350070&user_id=507fd0bb65c9f08e7b4b1a0ac732a5d6&kwd=mw&ptyp=namemyt&chn=email&url=//shabirsons.com/new/auth?register=raven@triton-partners.com	Get hash	malicious	Unknown	Browse	172.67.209.71 104.21.73.97
	https://cs.mytheresa.com/mix/c3/?tc_id=202311201201523757380094&tcs=3504&cid_vcms=6664627&ag=Category&lg=2&tar=TGT&src=newsletter&cmp=mw_42_231016_category&tarea=07&csf=23350070&user_id=507fd0bb65c9f08e7b4b1a0ac732a5d6&kwd=mw&ptyp=namemyt&chn=email&url=//baidu.com///link?url=vC4GC64ae4I9wzsoHp-V0ah20Me1UflwnvmnxUC9BRkuYSMm7qYp63-dMYBSTRdK&wd#.am9obm55X2RhdmlzQGFvLnVzY291cnRzLmdvdg==	Get hash	malicious	Unknown	Browse	172.67.209.71 104.21.73.97
	Payment_Slip_(SWIFT)#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.209.71 104.21.73.97
	payment_slip_copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.209.71 104.21.73.97
	Purchase_Enquiry-Y97STVZCPZC12AQ-03315904351-pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.209.71 104.21.73.97
	Commercial_Invoice_and_Packing_List.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	172.67.209.71 104.21.73.97
	https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwj_4JyDzIyDAxXVcaQEHcXmCEIQFnoECA8QAQ&url=https%3A%2F%2Fyouareanidiot.cc%2F&usg=AOvVaw36hjTACmKPOCzJrY34wLQm&opi=89978449	Get hash	malicious	Unknown	Browse	172.67.209.71 104.21.73.97
	last.hta	Get hash	malicious	AsyncRAT	Browse	172.67.209.71 104.21.73.97
	RHU-20230911759.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	172.67.209.71 104.21.73.97
	Order_20200703_&_20200704.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	172.67.209.71 104.21.73.97
	REMITTAN.EXE.exe	Get hash	malicious	AgentTesla	Browse	172.67.209.71 104.21.73.97
	fUHlaw338Z.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	172.67.209.71 104.21.73.97
	INVOLVED_No_548HR-BHDFH4571.exe	Get hash	malicious	AgentTesla	Browse	172.67.209.71 104.21.73.97

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 7, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.64343788909108
Encrypted:	false
SSDEEP:	384:A1zkVmvQhyn+Zoz67dNlIMMz333JGN8j/LKXYj5kuv:AUUMXCyIr
MD5:	B6787B79D64948AAC1D6359AC18AB268
SHA1:	0831EB15AB2B330BE95975A24F8945ED284D0BA4
SHA-256:	9D6FD3B8AB8AA7934C75EDE36CEB9CF4DDAD06C5031E89872B4E814D7DB674E2
SHA-512:	9296866380EF966F1CB6E69B7B84D1A86CD5AE8D9A7332C57543875FAA4FC7F1387A4CF83B7D662E4BAB0381E4AFC9CB9999075EBB497C6756DF770454F3530E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\fqs92o4p.default-release\key4.db

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\123.scr.exe.log

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.364175471524945
Encrypted:	false
SSDEEP:	24:ML9E4KQEAE4KKUNKKDE4KGKZI6KhPKIE4TKBGKoC1qE4GIs0E4K6sXE4Npv:MxHKQEAHKKkKYHKGSI6oPtHTHK1qHGI8
MD5:	1B713A2FD810C1C9A8F6F6BE36F406B1
SHA1:	0828576CB8B83C21F36AD29E327D845AB3574EBB
SHA-256:	E51E809582894F4D484939BE3990DFC914E43F4AF72AE55A00B01FCFE348763B
SHA-512:	D32200B7FA9D0DFEF4011D98D40260838A522E63C874FBCCE00D331D663169DBE1C613AD0E81C76F69A8CE6C7265605175CA75BA2C8BDA7748290B34579E148B
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Temp\tmp4714.tmp.tmpdb

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4754.tmp.dat

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp47D2.tmp.dat

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp47E3.tmp.dat

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4803.tmp.tmpdb

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4804.tmp.dat

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4824.tmp.dat

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4835.tmp.dat

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\44\Information.txt

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.0832474181366445
Encrypted:	false
SSDEEP:	6:pYcCFWl4BjJrxAcVIKwvU4wSTeldOYdvyXX1Zu0Ghkwnk7VgadA67X:pYzdRgMtSTeDPdvuV2kwnk7VfA6r
MD5:	61C1D9C869DFDCB266739B6EE3D73B1D
SHA1:	E7F488A9BF56AB46691DDE72B7A4F68C29CEB12A
SHA-256:	4FB3BEF75B7ACFF91D30D024EDC5CE5EA636D405AEF8CE75360D688F491CE986
SHA-512:	D84A3DDF1F3D2E375E93B2E0CCF0DF9FE0DC8FF58765DEC2DFF4C683566D24B9006D2ECF887A8713F2B56B5EE2D487F66C4BFCDC91D9A4E7FFEE13A8FA9882D4
Malicious:	false
Preview:	==================================================. Operating system: Windows 10 Pro (64 Bit). PC user: 302494/user. ClipBoard: . Launch: C:\Users\user\Desktop\123.scr.exe. ==================================================. Screen resolution: 1280x1024. Current time: 14/12/2023 03:40:50. HWID: 96DB7A4178. ==================================================. CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz. RAM: 4094MB. GPU: 6EU8CVZ1. ==================================================. IP Geolocation: Fail Fail. Log Date: 12/14/2023 1:40. BSSID: 00:50:56:a7:21:15. ==================================================

C:\Users\user\AppData\Roaming\44\Process.txt

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3983
Entropy (8bit):	4.8005476566412115
Encrypted:	false
SSDEEP:	24:X+d+dYMqx+d85w+dHI+d+dquVEz+d+dqqI+dqp+dQUqq+dpIqqqq+dXsqqQUp0+1:jvr3h0elAntCKlNj1
MD5:	2CD70879FD423F39A33B46E9E34F9234
SHA1:	9BFC56A0E0A2B1E6B1E79826215417463D67B5A1
SHA-256:	FCC3D4C42A49183B6A4FEA1CC64D280BCDD94C6C91B3981FAEAA40A1B50D6417
SHA-512:	642E829CCFC69F901ED09CC95ECB498D459CC29A829E56E24951C6BA6379C423717E836547CD019ACAFF764091A55FB5B46E5C55F14394E67ED37905C2F592B3
Malicious:	false
Preview:	NAME: svchost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: SjahCKjaHsLRzEBcouTlN..NAME: explorer..NAME: svchost..NAME: fontdrvhost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: smartscreen..NAME: SjahCKjaHsLRzEBcouTlN..NAME: csrss..NAME: SjahCKjaHsLRzEBcouTlN..NAME: SjahCKjaHsLRzEBcouTlN..NAME: svchost..NAME: sihost..NAME: OfficeClickToRun..NAME: WmiPrvSE..NAME: SjahCKjaHsLRzEBcouTlN..NAME: SjahCKjaHsLRzEBcouTlN..NAME: svchost..NAME: svchost..NAME: dasHost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: svchost..NAME: ctfmon..NAME: SjahCKjaHsLRzEBcouTlN..NAME: RuntimeBroker..NAME: svchost..NAME: svchost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: WinStore.App..NAME: svchost..NAME: svchost..NAME: svchost..NAME: svchost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: dllhost..NAME: svchost..NAME: svchost..NAME: RuntimeBroker..NAME: StartMenuExperienceHost..NAME: conhost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: fontdrvhost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: TextInputHost..NAME: svchost..NAME: SjahCKjaHsLRzEBcouTlN..NAME: SjahCKjaHsLRzEBcouTlN

C:\Users\user\AppData\Roaming\44\Screen.png

Download File

Process:	C:\Users\user\Desktop\123.scr.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	691639
Entropy (8bit):	7.926349446614741
Encrypted:	false
SSDEEP:	12288:YMfOKYUQ86m8cucHc7V/XgqEmdu91ErcsISyXvzfaqELWFC8qCYmVcanLQlGusbZ:Y+mUQwwzdu3fwYDapaMyaanLQoSvQ7
MD5:	0B4CE067DE97C622A67DAA49693FA1CD
SHA1:	201CC7D257056B7FA60089B580723E81217FEC78
SHA-256:	7E9BA83D9125805508CBFB1FD1DED6B407DDB571367DCE5144659E829022B3BB
SHA-512:	FC3C064159CA2F509B9EAAFA3716288D2CA904DD295227A9A6D8D9BD954B278333F0C693C19D91D534C33A35F30CA578D2471A8B2F3A8BBAF78F0E28B9CCC62B
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....]....V..}_w.w...'...}....xw<N..69(.s2.....6...LN"g!.m0.v.`2.$.DN.$...B..6v......U.[i..%........s.-....j.Z..7C....M.ssc+.....m._66....0.._.9......z...7#...x_.d,...\8L..u.v.........-..z.v...8.~..M.Y.7).9.:b.L..%.3.-.8}..O[..S....6.oj'....'....+*.z.~.=1..W.c_.+.......o/...U.~ky.....Y..o....._.{.....X1p...s....%%.v..WFG._.i.`..??]..>2.0..../>]1....}1.Wl..\|.%...........\|....}.D...b...G<^.5.v<h...c.\|...O=6.;o..~$.._.&\|.04......Hb...SK....>.....1O0f..a...'".=.&r....q............{.0.<..~0...!.U..x4L<4.q..a.......x.vn.....C.....9...V...{..a`..C}.E.....'>..xo1.. .v.A...1gRl'..y........9.q..>.Rkc..z.9.ah.Ea.~q.......$.{.W.&..P.t@.7.m...}..}.{...{.......}ob`.....=..a.~.Z...qw.....>........g..?....M.......=..=...\.{...q>.............=.0...D.Gl`V.wf........R..n.~#.......}.0+.k...XK;iV\33...c.......apZ.n..S. .<07y....._...P..W....S........8...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.985739733331055
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	123.scr.exe
File size:	562'176 bytes
MD5:	2cd8134f58cdbda71373f5ea79d5a422
SHA1:	f30cc8c8056e6943a4114e557615552f16cb8e2f
SHA256:	7e00639b962e167ab8463fa871f8fe12f6e38166a497d7ed8cf3a2370053d1f0
SHA512:	a6042ab229429830a0e98b17873b68b4799ccde6637e55ff7bbf94eaa6af0d4f89e019fea67a04a04550889be89a3db701372978584569cdd350e86a6a2f65a0
SSDEEP:	12288:nYhJzH0hGN8nVY5cdFWOh+0H0uc1k7EIKxih+sgPrv6KfNcyFEOYw76:YfwM+nVMcPVY0U7qHKxugjdeyFm
TLSH:	B7C423DE7654328ECC0BD039CD480EB83790697FAB8F4667552354E7860DAE28F252B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ye.........."......j...(........... ........@.. ....................................`................................

File Icon


Icon Hash:	20f02b23333b0022

Static PE Info

General

Entrypoint:	0x48892e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6579C99E [Wed Dec 13 15:11:26 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x888d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8a000	0x2488	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x86934	0x86a00	False	0.981515131731662	data	7.989676579902905	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8a000	0x2488	0x2600	False	0.9064555921052632	data	7.7074177570634514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x8a0a8	0x23c7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9523965498416858
RT_GROUP_ICON	0x8c470	0x14	data			1.05

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2023 01:40:58.645344973 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:58.645380974 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:58.645474911 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:58.744631052 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:58.744642019 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:59.017179966 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:59.017343998 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:59.034137011 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:59.034152031 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:59.034384966 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:59.074008942 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:59.112788916 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:59.160741091 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:59.333110094 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:59.333156109 CET	443	49729	104.21.73.97	192.168.2.4
Dec 14, 2023 01:40:59.333278894 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:59.337755919 CET	49729	443	192.168.2.4	104.21.73.97
Dec 14, 2023 01:40:59.471633911 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:40:59.471676111 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:40:59.471786976 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:40:59.472583055 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:40:59.472589970 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:40:59.746237993 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:40:59.746391058 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:40:59.749516964 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:40:59.749524117 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:40:59.749783993 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:40:59.751347065 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:40:59.796737909 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:41:00.104984045 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:41:00.105034113 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:41:00.105063915 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:41:00.105129957 CET	443	49730	172.67.209.71	192.168.2.4
Dec 14, 2023 01:41:00.105216980 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:41:00.105216980 CET	49730	443	192.168.2.4	172.67.209.71
Dec 14, 2023 01:41:00.114468098 CET	49730	443	192.168.2.4	172.67.209.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2023 01:40:58.504261017 CET	50956	53	192.168.2.4	1.1.1.1
Dec 14, 2023 01:40:58.630804062 CET	53	50956	1.1.1.1	192.168.2.4
Dec 14, 2023 01:40:59.341645956 CET	57311	53	192.168.2.4	1.1.1.1
Dec 14, 2023 01:40:59.470359087 CET	53	57311	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 14, 2023 01:40:58.504261017 CET	192.168.2.4	1.1.1.1	0x9b04	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)	false
Dec 14, 2023 01:40:59.341645956 CET	192.168.2.4	1.1.1.1	0xedc5	Standard query (0)	ipbase.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 14, 2023 01:40:58.630804062 CET	1.1.1.1	192.168.2.4	0x9b04	No error (0)	freegeoip.app	104.21.73.97	A (IP address)	IN (0x0001)	false
Dec 14, 2023 01:40:58.630804062 CET	1.1.1.1	192.168.2.4	0x9b04	No error (0)	freegeoip.app	172.67.160.84	A (IP address)	IN (0x0001)	false
Dec 14, 2023 01:40:59.470359087 CET	1.1.1.1	192.168.2.4	0xedc5	No error (0)	ipbase.com	172.67.209.71	A (IP address)	IN (0x0001)	false
Dec 14, 2023 01:40:59.470359087 CET	1.1.1.1	192.168.2.4	0xedc5	No error (0)	ipbase.com	104.21.85.189	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

freegeoip.app

ipbase.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	104.21.73.97	443	6840	C:\Users\user\Desktop\123.scr.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-14 00:40:59 UTC	67	OUT	GET /xml/ HTTP/1.1 Host: freegeoip.app Connection: Keep-Alive
2023-12-14 00:40:59 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 14 Dec 2023 00:40:59 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Thu, 14 Dec 2023 01:40:59 GMT Location: https://ipbase.com/xml/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d%2BcM1sShUPkmGykANeWMmAdGTZOi34KkDFrMXi7rTWDPGByWgjcEkgogtnTXQjrfA7vB81GHt2aRzrgsiQk%2Be4B2XHxMBjk4cStrY0kNWQZZDKc2ipynHJmSxQinGm9x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8352660a291f259a-MIA alt-svc: h3=":443"; ma=86400
2023-12-14 00:40:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	172.67.209.71	443	6840	C:\Users\user\Desktop\123.scr.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-14 00:40:59 UTC	64	OUT	GET /xml/ HTTP/1.1 Host: ipbase.com Connection: Keep-Alive
2023-12-14 00:41:00 UTC	741	IN	HTTP/1.1 404 Not Found Date: Thu, 14 Dec 2023 00:41:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Age: 21647 Cache-Control: public,max-age=0,must-revalidate Cache-Status: "Netlify Edge"; hit Vary: Accept-Encoding X-Nf-Request-Id: 01HHJWA1BAJX35GM5Y24XTNFQJ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xq%2FWqt8caz1AaVBhF6K5%2Bj6%2FLdXGBlzOJ3sLpNL2DQODjVELF611Dso8pASHSSBOXbBjr6pG1YvHk%2FwjWSov8Dqj4HlO6%2FW7MBZW6j%2BH6qM7x0jhxxYT343jCe2M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8352660eb98a748a-MIA alt-svc: h3=":443"; ma=86400
2023-12-14 00:41:00 UTC	628	IN	Data Raw: 63 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d Data Ascii: c0a<!DOCTYPE html><html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> <title>Page Not Found</title> <link href='https://fonts.googleapis.com
2023-12-14 00:41:00 UTC	1369	IN	Data Raw: 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 6d 61 69 6e 20 7b 0a 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 Data Ascii: adding: 0; } h1 { margin: 0; font-size: 22px; line-height: 24px; } .main { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; hei
2023-12-14 00:41:00 UTC	1092	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 30 30 37 30 36 37 22 20 64 3d 22 4d 31 31 2e 39 39 39 38 38 33 36 2c 34 2e 30 39 33 37 30 38 30 33 20 4c 38 2e 35 35 38 30 39 35 31 37 2c 37 2e 34 33 32 39 34 39 35 33 20 43 38 2e 32 33 35 33 31 34 35 39 2c 37 2e 37 34 36 31 31 32 39 38 20 38 2e 32 33 35 33 31 34 35 39 2c 38 2e 32 35 33 38 38 37 33 36 20 38 2e 35 35 38 30 39 35 31 37 2c 38 2e 35 36 36 39 33 37 36 39 20 4c 31 32 2c 31 31 2e 39 30 36 32 39 32 31 20 4c 39 2e 38 34 31 38 37 38 37 31 2c 31 34 20 4c 34 2e 32 34 32 30 38 35 34 34 2c 38 2e 35 36 36 39 33 37 35 31 20 43 33 2e 39 31 39 33 30 34 38 35 2c 38 2e 32 35 33 38 38 37 31 39 20 33 2e 39 31 39 33 30 34 38 35 2c 37 2e 37 34 36 31 31 32 38 31 20 34 2e 32 34 32 30 38 35 34 34 2c 37 Data Ascii: <path fill="#007067" d="M11.9998836,4.09370803 L8.55809517,7.43294953 C8.23531459,7.74611298 8.23531459,8.25388736 8.55809517,8.56693769 L12,11.9062921 L9.84187871,14 L4.24208544,8.56693751 C3.91930485,8.25388719 3.91930485,7.74611281 4.24208544,7
2023-12-14 00:41:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:40:56
Start date:	14/12/2023
Path:	C:\Users\user\Desktop\123.scr.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\123.scr.exe
Imagebase:	0x1de8e380000
File size:	562'176 bytes
MD5 hash:	2CD8134F58CDBDA71373F5EA79D5A422
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.1686858017.000001DE900D8000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.1686858017.000001DE9000E000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BABB1FB Relevance: 1.4, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UYL, xrefs: 00007FFD9BABB283

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID: UYL
API String ID: 0-3063783504
Opcode ID: a873103ff36e18d3e0b337caba7b4d0fb91a0244dbe77dfc972654202684c37b
Instruction ID: c40659ac54efe0b8f31babbfc61b531b616019d6d0a1b46d7d8661172366d191
Opcode Fuzzy Hash: a873103ff36e18d3e0b337caba7b4d0fb91a0244dbe77dfc972654202684c37b
Instruction Fuzzy Hash: 7151A830B0D7590FD32DAB788C355757BA1EB96310F1582BED4ABCB2E3DD24A9068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB0568 Relevance: 1.0, Instructions: 1008
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d102c1e12c69dc39873680951fcea437267441f0d199143cf7f60e5796ba04
Instruction ID: 8a8f4021fa600c3a6e41d2c988e8742a1673ea7daac593f50c3bf1d83520d603
Opcode Fuzzy Hash: c3d102c1e12c69dc39873680951fcea437267441f0d199143cf7f60e5796ba04
Instruction Fuzzy Hash: 6D62C030729A198FD728DB68C4A497573E2FFA4304F21467DD09BC76A6DE25F942CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB089D Relevance: .8, Instructions: 843
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3718211c4f35b417a96d44047366a5403a9b467aab633fc3c0777d732f2133cc
Instruction ID: 8753f0f8542dc9934b4b199cb3bf9e8fb2304fdf8bfbf1a74ab1ede314043862
Opcode Fuzzy Hash: 3718211c4f35b417a96d44047366a5403a9b467aab633fc3c0777d732f2133cc
Instruction Fuzzy Hash: 88428B30B1DA494FE76CDB2D84A5535BBD2EF99704B1542BFD05ACB2ABDD24E8028780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB4F7F Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b7514910585fd3e8d5fb89d4b99fc16434f3756c7ebfd650d8646c4fa571da
Instruction ID: 9e42cb3baf5c0a5bd4f6f6219c8ee528612644b8862a8e07530c01f13d7803c7
Opcode Fuzzy Hash: e9b7514910585fd3e8d5fb89d4b99fc16434f3756c7ebfd650d8646c4fa571da
Instruction Fuzzy Hash: 7261F432B08A1D4BE71CABAC98656F973D1EF98315F00427ED40FCB2DADE6568468680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB07B8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f440966199f7d7cb809d863ff1c9dddd8832cef2f7780f03a71e2bdc95100b
Instruction ID: 454b1345f9355b91dc09dfe79532a60c1c6515fb544b56217b6e2a8f11a8217d
Opcode Fuzzy Hash: 09f440966199f7d7cb809d863ff1c9dddd8832cef2f7780f03a71e2bdc95100b
Instruction Fuzzy Hash: 1C110832B0C51C0F972C9A6C9C1A47B77DAD3C6231B12933FE597C26A5EC65680305C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB84FA Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M_^, xrefs: 00007FFD9BAB862A

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID: M_^
API String ID: 0-921959145
Opcode ID: bd1a2be79a96289867f64466aebbf7b01a294b4e7ee61aad6650b0ae3c5da984
Instruction ID: bcb445557b6ff4a0bb6d3408e1007f8b6e40dfd2a03f2b94177506c175ee819e
Opcode Fuzzy Hash: bd1a2be79a96289867f64466aebbf7b01a294b4e7ee61aad6650b0ae3c5da984
Instruction Fuzzy Hash: 14614A72A0D5598FD718AB9C98665E977E0FF25329B0403BED06DC7193FE2474028785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB85D3 Relevance: 1.6, APIs: 1, Instructions: 119
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFD9BAB9AA1

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5ef17dba861b76e66242dbee4864ca02bfebbc48471bedf2f632d894866625a4
Instruction ID: 2f1313db23ee1596745e057c48ee5a2e8380ec89035a7f5205bd0dabf8538a8d
Opcode Fuzzy Hash: 5ef17dba861b76e66242dbee4864ca02bfebbc48471bedf2f632d894866625a4
Instruction Fuzzy Hash: EA310831A0CA5C4FDB18EF9C98496F9BBE1EF66321F04026FD059D31A2CB606846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB6A82 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI ref: 00007FFD9BAE0378

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 89c33237da8cc04525ffef13c6dfa4edd65544c08b48e3c5058dd0ce917d9405
Instruction ID: f5113e3d81a3cbe0be92c45a8bccce138a7157e36b14b3e03036d7db253a9f1b
Opcode Fuzzy Hash: 89c33237da8cc04525ffef13c6dfa4edd65544c08b48e3c5058dd0ce917d9405
Instruction Fuzzy Hash: B231923191CA0C9FDB28EF98984A6F9B7F1FB69321F10422ED04ED3651DB70A845CB85

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BAB0730 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FFD9BABAB29

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 16c61b19668b806bb7206d8f0ab739ecb6003fe28be526068f8fe4dc00577c87
Instruction ID: f40c54bfc2f5aba45409558043db7f3e10e8968125011f443c4969a7fb0190e9
Opcode Fuzzy Hash: 16c61b19668b806bb7206d8f0ab739ecb6003fe28be526068f8fe4dc00577c87
Instruction Fuzzy Hash: 9B513B32A0D79A0FD31E967C88651A17BE5DB8721070982FFD4D6CB2E7E858AC078791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB0500 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88085e9be040cc6bbf3f0820fc01236f83e178dfd056e588ae2db5f3c6cce6a0
Instruction ID: 93b7afeb71b381201edab1d78a81fe4a34e586cd616e165b9dd77341f0b2e060
Opcode Fuzzy Hash: 88085e9be040cc6bbf3f0820fc01236f83e178dfd056e588ae2db5f3c6cce6a0
Instruction Fuzzy Hash: 26B19D21B0E79D0FD33997E8A8A45717FD0EF46310F1601BFC4AAC71A7D859A9478781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BABDC7F Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1472fc6af60f44fe4a844e0e6a07087b4a666460b1835ef8a6d76aa8956471
Instruction ID: 7f00b6b2267f4ec71284094090d1aeeac155cf64c53428812383fd4b450ffaaf
Opcode Fuzzy Hash: fc1472fc6af60f44fe4a844e0e6a07087b4a666460b1835ef8a6d76aa8956471
Instruction Fuzzy Hash: 1A813462A0D7C54FD31A8B7488611A07FA1EF13310F0A85FFD4C6CB1E3EA28691AC752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB9C34 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e5b0802328144b534cec2e1f260e87d12d0385bdeee7f897caa99fe5bbef7a
Instruction ID: 93a8f2948e20f6933a40e7f6a3600c2af7f76b994bae2fea6fc33927a5eaba49
Opcode Fuzzy Hash: 24e5b0802328144b534cec2e1f260e87d12d0385bdeee7f897caa99fe5bbef7a
Instruction Fuzzy Hash: F651046150E3C90FD31B9B748C665A17FB5EF43210B0A81EFD0D6CB1B7E91859178762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BABDB36 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589f95c2ef29d6957b3acffd47114c66473faaa6e72600449ee9069364dc8c57
Instruction ID: ede3a2b0fffc03fd181544dcbfda61441bb64b735685a6f87700e3076e483329
Opcode Fuzzy Hash: 589f95c2ef29d6957b3acffd47114c66473faaa6e72600449ee9069364dc8c57
Instruction Fuzzy Hash: 97417B31A0E3890FD31A9E788C55472BFA5EB83310B1582EFD4C6CB1B7DA285907C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAB8A10 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693741572.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bab0000_123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ceffa9f5de73159c7cccb18bc9990f431269da7ff628ea7ce845fd90feac88
Instruction ID: 24424e346730d1377f219f916352057f55ae4dc5ebecc520b96505f2326ca779
Opcode Fuzzy Hash: c7ceffa9f5de73159c7cccb18bc9990f431269da7ff628ea7ce845fd90feac88
Instruction Fuzzy Hash: C3216E3230D6480FE31D9A789C665B27B99E783221B06427FD4D3C71E3DC48A8134791

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 123.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\fqs92o4p.default-release\cert9.db

C:\Users\Public\fqs92o4p.default-release\key4.db

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\123.scr.exe.log

C:\Users\user\AppData\Local\Temp\tmp4714.tmp.tmpdb

C:\Users\user\AppData\Local\Temp\tmp4754.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp47D2.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp47E3.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp4803.tmp.tmpdb

C:\Users\user\AppData\Local\Temp\tmp4804.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp4824.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp4835.tmp.dat

C:\Users\user\AppData\Roaming\44\Information.txt

C:\Users\user\AppData\Roaming\44\Process.txt

C:\Users\user\AppData\Roaming\44\Screen.png

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
123.scr.exe

Function 00007FFD9BABB1FB Relevance: 1.4, Strings: 1, Instructions: 172
COMMON

Function 00007FFD9BAB0568 Relevance: 1.0, Instructions: 1008
COMMON

Function 00007FFD9BAB089D Relevance: .8, Instructions: 843
COMMON

Function 00007FFD9BAB84FA Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 230
COMMON

Function 00007FFD9BAB85D3 Relevance: 1.6, APIs: 1, Instructions: 119
memoryCOMMON

Function 00007FFD9BAB6A82 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON