Edit tour

Windows Analysis Report
SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
Analysis ID:	1401858
MD5:	e48a16d4ebf8d89f865d8bce8bee62bc
SHA1:	744f2e4dcc209d6fe89763a98a200f389f136a33
SHA256:	9cca6dbd850e46175cd1c039676659b72d211140833e91a66992ac627200475a
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Installs a global keyboard hook

Allocates memory with a write watch (potentially for evading sandboxes)

Detected potential crypto function

Enables debug privileges

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe (PID: 6972 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe MD5: E48A16D4EBF8D89F865D8BCE8BEE62BC)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Virustotal: Detection: 15%

Perma Link

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Lenovo\source\repos\JAVAR V2\keylogger module 2\bin\Release\keylogger module 2.pdb source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Code function: 0_2_0182F1C4		0_2_0182F1C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Code function: 0_2_064FDA70		0_2_064FDA70

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe, 00000000.00000000.1998263473.0000000000D92000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekeylogger module 2.exeF vs SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe, 00000000.00000002.3243286641.0000000001137000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe, 00000000.00000002.3243457916.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Binary or memory string: OriginalFilenamekeylogger module 2.exeF vs SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Section loaded: textshaping.dll	Jump to behavior

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.spyw.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Mutant created: \Sessions\1\BaseNamedObjects\{aboba-B9A1-45fd-A8CF-72F04E6BDE8F}

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Virustotal: Detection: 15%

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\Lenovo\source\repos\JAVAR V2\keylogger module 2\bin\Release\keylogger module 2.pdb source: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Code function: 0_2_064C213B push esp; ret		0_2_064C2141
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Code function: 0_2_064F28E1 pushad ; ret		0_2_064F28ED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Memory allocated: 1820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Memory allocated: 5180000 memory reserve \| memory write watch	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	11 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	5%	ReversingLabs
SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe	16%	Virustotal		Browse

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1401858
Start date and time:	2024-03-02 12:26:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
Detection:	MAL
Classification:	mal52.spyw.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 18 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.7008651716085605
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
File size:	61'952 bytes
MD5:	e48a16d4ebf8d89f865d8bce8bee62bc
SHA1:	744f2e4dcc209d6fe89763a98a200f389f136a33
SHA256:	9cca6dbd850e46175cd1c039676659b72d211140833e91a66992ac627200475a
SHA512:	dba3d0dd0b46cf9f7d92729576574baf7de2dd23da119637363b4ef19d172eb1854e26e2f6a422ad5f3d65cb7f6e94d0ce551e65a5b37708a7f37fc21cd7a943
SSDEEP:	1536:W0P8DXMINbqUInqzq1EUa7D8O7Jjw8piAFW:AIKq1ETw8E
TLSH:	4B534AA46F8E4537C6AD6BBF70D317520378CAA69003E7EB5DEA21B41C937480D315AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... .a............................v.... ... ....@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x410576
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x61ED20DB [Sun Jan 23 09:33:15 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00410584h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop eax
add eax, 00000001h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10528	0x4c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x5f6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1058c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10584	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe61c	0xe800	6d1f05d5bab41849e80c783b60e70948	False	0.41818763469827586	data	5.771477350623775	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x5f6	0x600	ebd364afdc82351dcbd15061dbe05afe	False	0.421875	data	4.172337071353766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	21b83b1cee5608e8cf03ee5a6595949f	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x12090	0x36c	data			0.3995433789954338
RT_MANIFEST	0x1240c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

• SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Click to jump to process

Memory Usage

• SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	12:26:58
Start date:	02/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe
Imagebase:	0xd80000
File size:	61'952 bytes
MD5 hash:	E48A16D4EBF8D89F865D8BCE8BEE62BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	348
Total number of Limit Nodes:	21

Executed Functions

Function 0182B037 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0182B29E

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2f0fed5b596b61e2eb97846980bee900b9a89b422988d122fcdf8648cb97a15e
Instruction ID: ed3cc17f73a5ee54bb42a09c9b47e21c357bc203b50c4ca52454643fa9554f3d
Opcode Fuzzy Hash: 2f0fed5b596b61e2eb97846980bee900b9a89b422988d122fcdf8648cb97a15e
Instruction Fuzzy Hash: 4E818770A01B158FD726CF29D44475ABBF2FF88300F10892ED48AC7A50DB74EA89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01824520 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01825A41

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 75e8e7913671cc1feafa97dc902d5eba1f5c554c15a61339fbb34b2ac90f05f5
Instruction ID: a760cae70886ec160ef292e79b85f134ac84a40847838e30af240ed000a49d5c
Opcode Fuzzy Hash: 75e8e7913671cc1feafa97dc902d5eba1f5c554c15a61339fbb34b2ac90f05f5
Instruction Fuzzy Hash: 214102B0C0032DCBDB25CFA9C884BDDBBB5BF48704F20806AD409AB254D7B56985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01825985 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01825A41

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e7ca498ce4faeae30c34c986dc8c436be86d2dce4264bd3409ff1aad3d84659a
Instruction ID: 597cb2ff1825847f1f3b14599e2156c2f73337f11aeff97c58c7c070ccbf1f0d
Opcode Fuzzy Hash: e7ca498ce4faeae30c34c986dc8c436be86d2dce4264bd3409ff1aad3d84659a
Instruction Fuzzy Hash: 1D41E3B0C00729CFDB25CFA9C985BDDBBB1BF48704F20806AD409AB255DB756989CF90

Uniqueness

Uniqueness Score: -1.00%

Function 064CF4F9 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,064CF4E5,?,?), ref: 064CF597

Memory Dump Source

Source File: 00000000.00000002.3245341475.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_SecuriteInfo.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: e0b3e04cf8021719b55f167c8c8f0fd526461f01ea77be8c70f3a043e2c01e86
Instruction ID: 4c1d2dc7d1059915ba085137dca0d1e3bfa9e373c05d9085627b5ccede655f84
Opcode Fuzzy Hash: e0b3e04cf8021719b55f167c8c8f0fd526461f01ea77be8c70f3a043e2c01e86
Instruction Fuzzy Hash: 3C31B2B5D01249AFDB51CF9AD884ADEFBF5FF48320F14842AE919A7310D774A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 064CDD54 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,064CF4E5,?,?), ref: 064CF597

Memory Dump Source

Source File: 00000000.00000002.3245341475.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_SecuriteInfo.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 4e8b3e6f5c4d76f5a08b83aa99a02396659c1f61a23c435db4fb52b38d6d4383
Instruction ID: d694a59285976a94a68a65d8f38e0b30d854324580048fbb975aa6a62412311b
Opcode Fuzzy Hash: 4e8b3e6f5c4d76f5a08b83aa99a02396659c1f61a23c435db4fb52b38d6d4383
Instruction Fuzzy Hash: 5831D1B5D002099FDB50CF9AD884AAEFBF5FF48320F14842EE919A7311D374A945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 064FBF4C Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?,?,?,?,04183590,?,?,064FC32F,00000000,00000000), ref: 064FC448

Memory Dump Source

Source File: 00000000.00000002.3245419238.00000000064F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64f0000_SecuriteInfo.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 16b5117d4eae0cc0d034b26ff6469e48a353f4ae5366793e8542652db784c936
Instruction ID: cefa5dc138ecc48ede5bbd464673021daa86377e08508d5ea55ab950e199be27
Opcode Fuzzy Hash: 16b5117d4eae0cc0d034b26ff6469e48a353f4ae5366793e8542652db784c936
Instruction Fuzzy Hash: 952113B49102199FCB50DFA9D984AEEFBF5FF48310F10842AE919A7350C779A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 064FC3B0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?,?,?,?,04183590,?,?,064FC32F,00000000,00000000), ref: 064FC448

Memory Dump Source

Source File: 00000000.00000002.3245419238.00000000064F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64f0000_SecuriteInfo.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: e916d9b9fed0b4a00ef2ffbff91b83eb2c98e65cf1dc02d2f353463e46d782d7
Instruction ID: 177fc8e33b47c62d6b98c456fe9708c058f384572e1b1781989d3a6199c34d6b
Opcode Fuzzy Hash: e916d9b9fed0b4a00ef2ffbff91b83eb2c98e65cf1dc02d2f353463e46d782d7
Instruction Fuzzy Hash: 232115B4D002199FCB50DFA9D984AEEFBF5FF48310F10841AE519A7350C779A940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0182D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0182D8EE,?,?,?,?,?), ref: 0182D9AF

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: adcb85e43cdbac29e7ab4c60cf8595e9dd36da7ed715e6accd6d19705278aeab
Instruction ID: 59f4700d25b1445cf54ddc6d87d58661d71191ae5e014821d8f808358883490f
Opcode Fuzzy Hash: adcb85e43cdbac29e7ab4c60cf8595e9dd36da7ed715e6accd6d19705278aeab
Instruction Fuzzy Hash: 1A21D4B59002589FDB10CF9AD584AEEBFF5EB48310F14841AE918A7310D378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0182D920 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0182D8EE,?,?,?,?,?), ref: 0182D9AF

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 695a78a24759aa6c2fe81418f7f5d6b0b3e72c44f9bf32a5aed3f60df19c2e5e
Instruction ID: 3ced2b4914ae08b8cadcd8e3b68439899198678abb8f6037b327a5f8528b41ae
Opcode Fuzzy Hash: 695a78a24759aa6c2fe81418f7f5d6b0b3e72c44f9bf32a5aed3f60df19c2e5e
Instruction Fuzzy Hash: E321E0B59002489FDB10CFA9D984ADEBFF5FB08310F14845AE918B3350D378AA94CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0182A428 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0182B319,00000800,00000000,00000000), ref: 0182B92A

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 85ed1181ac7996d0e66f09f72f2076ac656e5f8f819852725d87aeb53afd3957
Instruction ID: f5be6427c447a5363ef520668d084b65bae38d164461a1e0f9a4cec38bac30bf
Opcode Fuzzy Hash: 85ed1181ac7996d0e66f09f72f2076ac656e5f8f819852725d87aeb53afd3957
Instruction Fuzzy Hash: 551126B6D013198FDB20CF9AD444AEEFBF4EB48310F10842AD519B7200D379A645CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0182B8B9 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0182B319,00000800,00000000,00000000), ref: 0182B92A

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 848628a09389607c022dd5ee1a19b5a7b80baef50a7ad1d1aace85f36c5d8401
Instruction ID: fe57c514ad5a52ff23e5a53737b393bf52e5c3eaff856c51a3e82a34e1d92278
Opcode Fuzzy Hash: 848628a09389607c022dd5ee1a19b5a7b80baef50a7ad1d1aace85f36c5d8401
Instruction Fuzzy Hash: 2711E4B6D002598FDB10CF9AD484AEEFFF5EF48310F14841AD519A7210C379A645CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 064FD450 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064FD4AD

Memory Dump Source

Source File: 00000000.00000002.3245419238.00000000064F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64f0000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9ba89f8cbc74842ea11faeaca177d9528cbba18abb645680730dfe2e351c2e36
Instruction ID: 0a394ff08dbde0ef1b0a5331fb682e7ad379d54694bec14891d8fec30a2e0e76
Opcode Fuzzy Hash: 9ba89f8cbc74842ea11faeaca177d9528cbba18abb645680730dfe2e351c2e36
Instruction Fuzzy Hash: EB1106B5D103588FCB20DF9AD545BDEBFF8AB48310F148459E518B7250C379A644CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0182B238 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0182B29E

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 91197ed44e21a53fd991fdc79dcd7bf7e74ba8c10521eff1cd2b02dbc87472eb
Instruction ID: 9fc108dc8699800704dfd20efd79a6ba8678c10f75909fc16f8b4a2c83303f10
Opcode Fuzzy Hash: 91197ed44e21a53fd991fdc79dcd7bf7e74ba8c10521eff1cd2b02dbc87472eb
Instruction Fuzzy Hash: 44110FB5C003598FDB10CF9AC444A9EFBF4EB89310F10841AD929A7210C379A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 064FC8E0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 064FD4AD

Memory Dump Source

Source File: 00000000.00000002.3245419238.00000000064F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64f0000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f316be8de57c4723a1b8d1abcbb488e313a81f66285b124b981eea1c22b6505b
Instruction ID: f77b902df8f57144b8f08f8d53667568d57bc93044b4512d8c86d3a77d57184e
Opcode Fuzzy Hash: f316be8de57c4723a1b8d1abcbb488e313a81f66285b124b981eea1c22b6505b
Instruction Fuzzy Hash: BD1103B1D103488FCB60EF9AD548B9EFBF8EB48320F10845AD619A7310C379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 017DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243987688.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17dd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff43a4dd80fa49cecdc66e179766583cdd847271df9ba6e6ab722ec8ce4a93c
Instruction ID: 911f388ba775a05c77522331add111e5aa21efefc1cc8b77116ac807f1f09ab7
Opcode Fuzzy Hash: 3ff43a4dd80fa49cecdc66e179766583cdd847271df9ba6e6ab722ec8ce4a93c
Instruction Fuzzy Hash: B021D071604208DFDB25DFA8D984B26FF75EB88354F24C5A9D90A4B296C33AD406CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 017DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243987688.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17dd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c844ca3a1ec564aa6dfee55099dfd7b659f5902bab70ba40c9f927f377bcaf2
Instruction ID: 571c61f5017ccdd8d5da9486462b8fc6d54f400097b8d4e5a9ff9da573228d7d
Opcode Fuzzy Hash: 8c844ca3a1ec564aa6dfee55099dfd7b659f5902bab70ba40c9f927f377bcaf2
Instruction Fuzzy Hash: F621F871548208DFDB15DF94D5C0F25FB75FB84324F20C5ADD9494B296C33AE406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 017DD005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243987688.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17dd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d38245f84f9178cdc52c9dd14062488a5524c84929edecf24214ae01937142
Instruction ID: fffcfa024480028c74aa3ac5039796c7516020b6dae34cfe2da6a70e0dc287f0
Opcode Fuzzy Hash: d9d38245f84f9178cdc52c9dd14062488a5524c84929edecf24214ae01937142
Instruction Fuzzy Hash: 7D2192755083849FCB13CF64D994711BF71EB86214F28C5EAD8498F2A7C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 017DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3243987688.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17dd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 7292c6609e33863085d638b3b07850de5d8ac817b0315c2be814677483c31716
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 5511BB75508284DFDB12CF54C6C4B15FFB1FB84224F24C6A9D8494B696C33AE40ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 064FDA70 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3245419238.00000000064F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64f0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7617e3e68488b37cd439baf027196f1917c51dc85881064e4c96c44bc92a0d
Instruction ID: 8c9c7e8d9b139b163f210dae1d438776695586a63708ba86f248d8d94b4d65d9
Opcode Fuzzy Hash: 6e7617e3e68488b37cd439baf027196f1917c51dc85881064e4c96c44bc92a0d
Instruction Fuzzy Hash: 3AF15C30E102098FDB54DFA9C944B9EBBF2FF48314F14816AE509AF3A5DB74A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0182F1C4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244236697.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e5ac2a122c97a2e4f7d904f51b396d9bcd652ed1d07f03caa9b07762ec8e3f
Instruction ID: 72e995f143aace2d3c0be9ad6b82f76e817de6b4b3fe133c4de65b66f7f5001a
Opcode Fuzzy Hash: 68e5ac2a122c97a2e4f7d904f51b396d9bcd652ed1d07f03caa9b07762ec8e3f
Instruction Fuzzy Hash: 21A17535E00229CFCF06DFB8C44459EB7B2FF85304B158569E905EB255DB71EA85CB50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exePID: 6972, Parent PID: 1028

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Windows Analysis Report
SecuriteInfo.com.Malicious_Behavior.SB.15788.19774.exe

Function 0182B037 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Function 01824520 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 01825985 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 064CF4F9 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Function 064CDD54 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Function 064FBF4C Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Function 064FC3B0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Function 0182D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0182D920 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 0182A428 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON