Edit tour

Windows Analysis Report
SecuriteInfo.com.Heur.18737.25106.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Heur.18737.25106.exe
Analysis ID:	1414901
MD5:	256ab4b69efe3560e3589e6d7c0d54d5
SHA1:	b138a1744e1030a7bccf18c0d30bef2525be3176
SHA256:	d5af1b5ed5eeca90dc835ed26ffc8a8854890eeefa32aacaa094b5d606d4edda
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Heur.18737.25106.exe (PID: 6156 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe" MD5: 256AB4B69EFE3560E3589E6D7C0D54D5)

SecuriteInfo.com.Heur.18737.25106.exe (PID: 5892 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe" MD5: 256AB4B69EFE3560E3589E6D7C0D54D5)

SecuriteInfo.com.Heur.18737.25106.exe (PID: 4256 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe" MD5: 256AB4B69EFE3560E3589E6D7C0D54D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elec-qatar.com", "Username": "mohammed.abrar@elec-qatar.com", "Password": "MHabrar2019@#"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3282091389.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.3282091389.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3282091389.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 6156	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 6156	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 6156	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 4256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 4256	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33853:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31735:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31851:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3192d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a53:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dee3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df55:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfdf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e071:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e14d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa896d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x12c103:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x166b23:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a1343:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x12c175:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x166b95:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a13b5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x12c1ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x166c1f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a143f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x12c291:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x166cb1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a14d1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12c2fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x166d1b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a153b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x12c36d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x166d8d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a15ad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x12c403:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x166e23:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a1643:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xafae3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xea503:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x124d23:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xafb55:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xea575:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x124d95:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xafbdf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xea5ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x124e1f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xafc71:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xea691:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x124eb1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xafcdb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xea6fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x124f1b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xafd4d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xea76d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x124f8d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xafde3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xea803:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x125023:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 50.87.139.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe, Initiated: true, ProcessId: 4256, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49708

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Heur.18737.25106.exe

Avira: detected

Found malware configuration

Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elec-qatar.com", "Username": "mohammed.abrar@elec-qatar.com", "Password": "MHabrar2019@#"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Heur.18737.25106.exe	Virustotal: Detection: 48%			Perma Link
Source: SecuriteInfo.com.Heur.18737.25106.exe	ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: SecuriteInfo.com.Heur.18737.25106.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.fe0000.0.unpack

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_09BB1320
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_09BB1315
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_09BB1490
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_09BB1490
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_09BB1485
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_09BB1485
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then jmp 09BBEAF4h	0_2_09BBE40F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then jmp 09BBEAF4h	0_2_09BBE45B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_09BB17B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_09BB17B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_09BB17A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_09BB17A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then xor edx, edx	0_2_09BB16E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4x nop then xor edx, edx	0_2_09BB16DC

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 50.87.139.143:587

Source: Joe Sandbox View

IP Address: 50.87.139.143 50.87.139.143

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 50.87.139.143:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: mail.elec-qatar.com

Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000004.00000002.3282091389.0000000002C26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.elec-qatar.com
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.18737.25106.exe, 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033191147.00000000033FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.alegsoftware.ga/ws_switches/contatore/ltromatic.ttf
Source: SecuriteInfo.com.Heur.18737.25106.exe	String found in binary or memory: https://fsf.org/
Source: SecuriteInfo.com.Heur.18737.25106.exe	String found in binary or memory: https://www.gnu.org/licenses/
Source: SecuriteInfo.com.Heur.18737.25106.exe	String found in binary or memory: https://www.gnu.org/licenses/why-not-lgpl.html

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, NmHr1WHWKO.cs

.Net Code: IiB

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E2581	0_2_016E2581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E3428	0_2_016E3428
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E1410	0_2_016E1410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E08D1	0_2_016E08D1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E1B82	0_2_016E1B82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E5152	0_2_016E5152
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E1370	0_2_016E1370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E3350	0_2_016E3350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E32E9	0_2_016E32E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E5508	0_2_016E5508
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E54F8	0_2_016E54F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E5700	0_2_016E5700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E5710	0_2_016E5710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E5960	0_2_016E5960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E5970	0_2_016E5970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E5B59	0_2_016E5B59
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E4E60	0_2_016E4E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E4E50	0_2_016E4E50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB3982	0_2_09BB3982
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB3A28	0_2_09BB3A28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB3A1A	0_2_09BB3A1A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BBBFF0	0_2_09BBBFF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB1E90	0_2_09BB1E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB1E80	0_2_09BB1E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB9E39	0_2_09BB9E39
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BBA290	0_2_09BBA290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB3458	0_2_09BB3458
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BB3448	0_2_09BB3448
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BBA6B8	0_2_09BBA6B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BBC6A0	0_2_09BBC6A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09BBC691	0_2_09BBC691
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_09F70448	0_2_09F70448
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_010C9B30	4_2_010C9B30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_010C41C8	4_2_010C41C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_010CD86F	4_2_010CD86F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_010C4A98	4_2_010C4A98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_010C3E80	4_2_010C3E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_060656C8	4_2_060656C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_06063F40	4_2_06063F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_0606BCF0	4_2_0606BCF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_0606DCF8	4_2_0606DCF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_06069AD0	4_2_06069AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_06062AF8	4_2_06062AF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_06068BFB	4_2_06068BFB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_06060040	4_2_06060040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_06064FE8	4_2_06064FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 4_2_06063233	4_2_06063233

Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2032614084.00000000018FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033191147.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000000.2021917953.00000000010A4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKawm.exe4 vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2041671290.0000000009EE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033191147.00000000033FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameriched20.dllp( vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033191147.00000000033FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033191147.00000000033FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\000004B0\\OriginalFilename vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000004.00000002.3280695547.00000000009B8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SecuriteInfo.com.Heur.18737.25106.exe
Source: SecuriteInfo.com.Heur.18737.25106.exe	Binary or memory string: OriginalFilenameKawm.exe4 vs SecuriteInfo.com.Heur.18737.25106.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, qQScs3vgL2JPV0BlNn.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.8280000.11.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.3482958.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.3463780.6.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Heur.18737.25106.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Mutant created: NULL

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Heur.18737.25106.exe	Virustotal: Detection: 48%
Source: SecuriteInfo.com.Heur.18737.25106.exe	ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.fe0000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.fe0000.0.unpack

.NET source code contains potential unpacker

Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, qQScs3vgL2JPV0BlNn.cs	.Net Code: FxX4Is5DhD System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.344e71c.4.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.8260000.10.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, qQScs3vgL2JPV0BlNn.cs	.Net Code: FxX4Is5DhD System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, qQScs3vgL2JPV0BlNn.cs	.Net Code: FxX4Is5DhD System.Reflection.Assembly.Load(byte[])

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: 0xD2E4B502 [Fri Feb 13 10:25:06 2082 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_00FE21B7 pushad ; iretd	0_2_00FE21DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_00FE2545 pushfd ; retf	0_2_00FE2547
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E620B push esi; ret	0_2_016E620E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E2849 push FFFFFFE9h; retf	0_2_016E2850
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Code function: 0_2_016E0CD3 push E1FFFFFFh; retf	0_2_016E0CD8

Source: SecuriteInfo.com.Heur.18737.25106.exe

Static PE information: section name: .text entropy: 7.82806191300002

Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, trBNTD2yCrx784vKDd.cs	High entropy of concatenated method names: 'O1CLktI4rj', 'VdrLqy4nP1', 'Gi336Jc5Ru', 'QbL3dnQB5E', 'vBE39PHVfP', 'VFs3nmICch', 'vyV3Od4dHM', 'adL3elFh2f', 'b5K3gs1XAL', 'Gbk3ML5oPh'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	High entropy of concatenated method names: 'mjSsXTjWVD', 'mu7spvoCRe', 'l6VsmEBt0G', 'j9Os0p8K4J', 'BMkst6XTT4', 'Wass8L7S9o', 'Peps7MFRRm', 'hVysi13Fi4', 'JoQsEjqsrE', 'nmXsU2WT2a'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, piA3pllVerMqfaxNNZ.cs	High entropy of concatenated method names: 'rRcHRGeFa9', 'ND0HsUdOBU', 'kpuHL9jW5v', 'uGPHFowZb4', 'fNtHlkZPaM', 'VvXLtUp44Q', 'QbHL8YTPZ5', 'haAL7rdLl5', 'bXTLiJSdIV', 'i2tLElv7Tw'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, f33TFbwEDEwIrccHJr.cs	High entropy of concatenated method names: 'iybGiZbm26', 'NWAGUncbTD', 'nikZuuPkrP', 'lUQZva9tYf', 'C9rGomj8AR', 'CIaGD1aCsq', 'OQdG2wj30r', 'CgeGXJGYxv', 'cRYGpnVB8d', 'SUeGmLX5HY'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, YpFrJQUAoR7leweN7P.cs	High entropy of concatenated method names: 'WL3wM9S68i', 'A41wD8f7pS', 'apXwXwips1', 'QrtwptSs0Y', 'pt0wYHJ52u', 'Qlpw6672Qa', 'CYkwd8NyJi', 'nKdw9Q7BcB', 'dqtwntJBoZ', 'qpGwOTqKUD'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, GGG2TJZCJaX7vPWbEM.cs	High entropy of concatenated method names: 'RvPfj4LCYc', 'VHhfP1reQ5', 'V8efSgmB7t', 'fa3fY7hZJd', 'lsdfdO3THI', 'Q7Bf9mNc5K', 'qIhfOn0VbY', 'cV7fe8At12', 'E3yfMC8I6a', 'omnfo85Ays'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, ymFk2ohhq6204n10Gb.cs	High entropy of concatenated method names: 'r5KvFxHZQU', 'nkhvlwoyHG', 'ShwvBhB48o', 'sZjvK89Pig', 'ti8vwRc155', 'I7Kvx7qclI', 'OLWhne01q4jweaciDi', 'eXK1I0HAOyqffO175O', 'g2JxdYyWVUsQP3AgGw', 'PO1vvTmR8H'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, RvR29kVv3IvBR5v1Vm.cs	High entropy of concatenated method names: 'Jx2ZCB0GJA', 'lIdZsCPS8i', 'quBZ3xihxO', 'HHqZLogvvs', 'mUhZHOrfvP', 'HNvZFmDqR2', 'z7WZlFD8PK', 'zb6ZaYP3tj', 'OHdZBb23bT', 'kYRZKwGf6k'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, JJb8kXkICK3pIBXBB0.cs	High entropy of concatenated method names: 'pYmrvFuysl', 'MoprJWrUGd', 'DVnr4XJLnH', 'HwCrCSNyJb', 'n6CrsNWmUj', 'nA0rLcLism', 'LTWrHhDAtV', 'v91Z79LMhy', 'lk3ZiGCxOD', 'bobZEHmpZ6'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, qQScs3vgL2JPV0BlNn.cs	High entropy of concatenated method names: 'I4BJRHkLFf', 'espJCkcJKB', 'SxTJsMQMWA', 'vn1J3UXJMk', 'TDgJLHgDXj', 'MDfJHdD8qw', 'ybhJFeyVKY', 'r6WJluVoZJ', 'WvAJaxcUNU', 'HrnJBy3FXF'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, AT9mo5CRrR31EOXuft.cs	High entropy of concatenated method names: 'ajjFQf38Jr', 'DYEF1bc28Y', 'L8CFIBa0Ab', 'guRFWNUsFp', 'DVDFkIia2I', 'WeQFTJKhWv', 'wLiFqR9TW9', 'GQAFjNK0OD', 'PQyFPHvPiX', 'S0hFVhZqMQ'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, YhrWFwjFek2yOMLhRfX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tPZ5XwdcQE', 'f7c5pFj672', 'oqG5mrggd0', 'N6A503Ipho', 'H9A5ty4RFU', 'jE658UviKO', 'Cjk57EeFIo'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, LCiZcv8cfTBdLr9rRi.cs	High entropy of concatenated method names: 'DnEIT2Fbo', 'xIJWWIYv2', 'hKnTW9wcc', 'VLVqFSFLG', 'qJWPx3s7K', 'KkOVSQgLq', 'aFWJV7dmrjcai55921', 'HgJ01DsMW1uoOm4oXE', 'LlbZi1Kxr', 'QFk51DQb0'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, dHqJ02jqwviMq4WJmrL.cs	High entropy of concatenated method names: 'E1MrQITNWG', 'aqFr19C4Uy', 'q97rIib9tI', 'NNMrWHLLcU', 'NB2rkdTZMO', 'XVkrTXYG7R', 'zmerqLpj4c', 'iSUrjRpnC2', 'ccTrPn82tj', 'K9lrVCilIG'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, KWGj67pSWYgtEm4Htu.cs	High entropy of concatenated method names: 'Dispose', 'WuqvEL6Ib1', 'fm7bYOo8CK', 'FNvAAAZjq3', 'uAhvUi7Tag', 'hGuvz3EmyH', 'ProcessDialogKey', 'MM7buCBvVV', 'J5DbvcMmiM', 'Wl7bbmZM4T'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, hwt56m01NN1EHbZEtx.cs	High entropy of concatenated method names: 'ogMHmNWSVJ', 'kchH0nehqU', 'rGHHtGvE4x', 'ToString', 'wpuH8Sf0Bm', 'Xa0H7vrP3X', 'AiyCAi5fQkKUdLhqPAx', 'lUeont5Y0Ojw5TJ74PV', 'UPaak154kYCUbDZVGkh'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, PZg3iXf4RmL1S8LlAY.cs	High entropy of concatenated method names: 'FpfFCNGCOx', 'goYF3r9eR2', 'LyuFHN2e9x', 'i1xHUH8yMP', 'VdIHzogHBG', 'm18Fu0Nnxt', 'TE0Fvm6StH', 'oOgFbNb01V', 'SX7FJpLhT2', 'GqkF43TrUr'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, dtF8SP3TSfjKU2xINg.cs	High entropy of concatenated method names: 'C443WEbYGi', 'r8W3TcGYeJ', 'ioc3jo33ta', 'Qdl3PZLLnJ', 'Wvl3we8mN7', 'nqH3xMEylE', 'hS63GOtTNt', 'Ntq3ZKYPet', 'Nv63r0vx2q', 'n3T35XMI3V'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.9ee0000.12.raw.unpack, EAO5pb4nl8MQbmWoDv.cs	High entropy of concatenated method names: 'POEGBpZ35U', 'CPBGKQGY6J', 'ToString', 'C0OGCbM3Pm', 'RueGs1HihA', 'gnlG33jHbR', 'KEyGLrsQxv', 'rIIGHib5Hg', 'AvQGFeAwCb', 'L0VGlOWyRg'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.344e71c.4.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.344e71c.4.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.344e71c.4.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.344e71c.4.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.344e71c.4.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.8260000.10.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.8260000.10.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.8260000.10.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.8260000.10.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.8260000.10.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, trBNTD2yCrx784vKDd.cs	High entropy of concatenated method names: 'O1CLktI4rj', 'VdrLqy4nP1', 'Gi336Jc5Ru', 'QbL3dnQB5E', 'vBE39PHVfP', 'VFs3nmICch', 'vyV3Od4dHM', 'adL3elFh2f', 'b5K3gs1XAL', 'Gbk3ML5oPh'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	High entropy of concatenated method names: 'mjSsXTjWVD', 'mu7spvoCRe', 'l6VsmEBt0G', 'j9Os0p8K4J', 'BMkst6XTT4', 'Wass8L7S9o', 'Peps7MFRRm', 'hVysi13Fi4', 'JoQsEjqsrE', 'nmXsU2WT2a'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, piA3pllVerMqfaxNNZ.cs	High entropy of concatenated method names: 'rRcHRGeFa9', 'ND0HsUdOBU', 'kpuHL9jW5v', 'uGPHFowZb4', 'fNtHlkZPaM', 'VvXLtUp44Q', 'QbHL8YTPZ5', 'haAL7rdLl5', 'bXTLiJSdIV', 'i2tLElv7Tw'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, f33TFbwEDEwIrccHJr.cs	High entropy of concatenated method names: 'iybGiZbm26', 'NWAGUncbTD', 'nikZuuPkrP', 'lUQZva9tYf', 'C9rGomj8AR', 'CIaGD1aCsq', 'OQdG2wj30r', 'CgeGXJGYxv', 'cRYGpnVB8d', 'SUeGmLX5HY'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, YpFrJQUAoR7leweN7P.cs	High entropy of concatenated method names: 'WL3wM9S68i', 'A41wD8f7pS', 'apXwXwips1', 'QrtwptSs0Y', 'pt0wYHJ52u', 'Qlpw6672Qa', 'CYkwd8NyJi', 'nKdw9Q7BcB', 'dqtwntJBoZ', 'qpGwOTqKUD'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, GGG2TJZCJaX7vPWbEM.cs	High entropy of concatenated method names: 'RvPfj4LCYc', 'VHhfP1reQ5', 'V8efSgmB7t', 'fa3fY7hZJd', 'lsdfdO3THI', 'Q7Bf9mNc5K', 'qIhfOn0VbY', 'cV7fe8At12', 'E3yfMC8I6a', 'omnfo85Ays'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, ymFk2ohhq6204n10Gb.cs	High entropy of concatenated method names: 'r5KvFxHZQU', 'nkhvlwoyHG', 'ShwvBhB48o', 'sZjvK89Pig', 'ti8vwRc155', 'I7Kvx7qclI', 'OLWhne01q4jweaciDi', 'eXK1I0HAOyqffO175O', 'g2JxdYyWVUsQP3AgGw', 'PO1vvTmR8H'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, RvR29kVv3IvBR5v1Vm.cs	High entropy of concatenated method names: 'Jx2ZCB0GJA', 'lIdZsCPS8i', 'quBZ3xihxO', 'HHqZLogvvs', 'mUhZHOrfvP', 'HNvZFmDqR2', 'z7WZlFD8PK', 'zb6ZaYP3tj', 'OHdZBb23bT', 'kYRZKwGf6k'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, JJb8kXkICK3pIBXBB0.cs	High entropy of concatenated method names: 'pYmrvFuysl', 'MoprJWrUGd', 'DVnr4XJLnH', 'HwCrCSNyJb', 'n6CrsNWmUj', 'nA0rLcLism', 'LTWrHhDAtV', 'v91Z79LMhy', 'lk3ZiGCxOD', 'bobZEHmpZ6'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, qQScs3vgL2JPV0BlNn.cs	High entropy of concatenated method names: 'I4BJRHkLFf', 'espJCkcJKB', 'SxTJsMQMWA', 'vn1J3UXJMk', 'TDgJLHgDXj', 'MDfJHdD8qw', 'ybhJFeyVKY', 'r6WJluVoZJ', 'WvAJaxcUNU', 'HrnJBy3FXF'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, AT9mo5CRrR31EOXuft.cs	High entropy of concatenated method names: 'ajjFQf38Jr', 'DYEF1bc28Y', 'L8CFIBa0Ab', 'guRFWNUsFp', 'DVDFkIia2I', 'WeQFTJKhWv', 'wLiFqR9TW9', 'GQAFjNK0OD', 'PQyFPHvPiX', 'S0hFVhZqMQ'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, YhrWFwjFek2yOMLhRfX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tPZ5XwdcQE', 'f7c5pFj672', 'oqG5mrggd0', 'N6A503Ipho', 'H9A5ty4RFU', 'jE658UviKO', 'Cjk57EeFIo'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, LCiZcv8cfTBdLr9rRi.cs	High entropy of concatenated method names: 'DnEIT2Fbo', 'xIJWWIYv2', 'hKnTW9wcc', 'VLVqFSFLG', 'qJWPx3s7K', 'KkOVSQgLq', 'aFWJV7dmrjcai55921', 'HgJ01DsMW1uoOm4oXE', 'LlbZi1Kxr', 'QFk51DQb0'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, dHqJ02jqwviMq4WJmrL.cs	High entropy of concatenated method names: 'E1MrQITNWG', 'aqFr19C4Uy', 'q97rIib9tI', 'NNMrWHLLcU', 'NB2rkdTZMO', 'XVkrTXYG7R', 'zmerqLpj4c', 'iSUrjRpnC2', 'ccTrPn82tj', 'K9lrVCilIG'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, KWGj67pSWYgtEm4Htu.cs	High entropy of concatenated method names: 'Dispose', 'WuqvEL6Ib1', 'fm7bYOo8CK', 'FNvAAAZjq3', 'uAhvUi7Tag', 'hGuvz3EmyH', 'ProcessDialogKey', 'MM7buCBvVV', 'J5DbvcMmiM', 'Wl7bbmZM4T'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, hwt56m01NN1EHbZEtx.cs	High entropy of concatenated method names: 'ogMHmNWSVJ', 'kchH0nehqU', 'rGHHtGvE4x', 'ToString', 'wpuH8Sf0Bm', 'Xa0H7vrP3X', 'AiyCAi5fQkKUdLhqPAx', 'lUeont5Y0Ojw5TJ74PV', 'UPaak154kYCUbDZVGkh'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, PZg3iXf4RmL1S8LlAY.cs	High entropy of concatenated method names: 'FpfFCNGCOx', 'goYF3r9eR2', 'LyuFHN2e9x', 'i1xHUH8yMP', 'VdIHzogHBG', 'm18Fu0Nnxt', 'TE0Fvm6StH', 'oOgFbNb01V', 'SX7FJpLhT2', 'GqkF43TrUr'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, dtF8SP3TSfjKU2xINg.cs	High entropy of concatenated method names: 'C443WEbYGi', 'r8W3TcGYeJ', 'ioc3jo33ta', 'Qdl3PZLLnJ', 'Wvl3we8mN7', 'nqH3xMEylE', 'hS63GOtTNt', 'Ntq3ZKYPet', 'Nv63r0vx2q', 'n3T35XMI3V'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, EAO5pb4nl8MQbmWoDv.cs	High entropy of concatenated method names: 'POEGBpZ35U', 'CPBGKQGY6J', 'ToString', 'C0OGCbM3Pm', 'RueGs1HihA', 'gnlG33jHbR', 'KEyGLrsQxv', 'rIIGHib5Hg', 'AvQGFeAwCb', 'L0VGlOWyRg'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, trBNTD2yCrx784vKDd.cs	High entropy of concatenated method names: 'O1CLktI4rj', 'VdrLqy4nP1', 'Gi336Jc5Ru', 'QbL3dnQB5E', 'vBE39PHVfP', 'VFs3nmICch', 'vyV3Od4dHM', 'adL3elFh2f', 'b5K3gs1XAL', 'Gbk3ML5oPh'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, z2RJpjoL1Xyd4dyirB.cs	High entropy of concatenated method names: 'mjSsXTjWVD', 'mu7spvoCRe', 'l6VsmEBt0G', 'j9Os0p8K4J', 'BMkst6XTT4', 'Wass8L7S9o', 'Peps7MFRRm', 'hVysi13Fi4', 'JoQsEjqsrE', 'nmXsU2WT2a'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, piA3pllVerMqfaxNNZ.cs	High entropy of concatenated method names: 'rRcHRGeFa9', 'ND0HsUdOBU', 'kpuHL9jW5v', 'uGPHFowZb4', 'fNtHlkZPaM', 'VvXLtUp44Q', 'QbHL8YTPZ5', 'haAL7rdLl5', 'bXTLiJSdIV', 'i2tLElv7Tw'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, f33TFbwEDEwIrccHJr.cs	High entropy of concatenated method names: 'iybGiZbm26', 'NWAGUncbTD', 'nikZuuPkrP', 'lUQZva9tYf', 'C9rGomj8AR', 'CIaGD1aCsq', 'OQdG2wj30r', 'CgeGXJGYxv', 'cRYGpnVB8d', 'SUeGmLX5HY'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, YpFrJQUAoR7leweN7P.cs	High entropy of concatenated method names: 'WL3wM9S68i', 'A41wD8f7pS', 'apXwXwips1', 'QrtwptSs0Y', 'pt0wYHJ52u', 'Qlpw6672Qa', 'CYkwd8NyJi', 'nKdw9Q7BcB', 'dqtwntJBoZ', 'qpGwOTqKUD'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, GGG2TJZCJaX7vPWbEM.cs	High entropy of concatenated method names: 'RvPfj4LCYc', 'VHhfP1reQ5', 'V8efSgmB7t', 'fa3fY7hZJd', 'lsdfdO3THI', 'Q7Bf9mNc5K', 'qIhfOn0VbY', 'cV7fe8At12', 'E3yfMC8I6a', 'omnfo85Ays'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, ymFk2ohhq6204n10Gb.cs	High entropy of concatenated method names: 'r5KvFxHZQU', 'nkhvlwoyHG', 'ShwvBhB48o', 'sZjvK89Pig', 'ti8vwRc155', 'I7Kvx7qclI', 'OLWhne01q4jweaciDi', 'eXK1I0HAOyqffO175O', 'g2JxdYyWVUsQP3AgGw', 'PO1vvTmR8H'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, RvR29kVv3IvBR5v1Vm.cs	High entropy of concatenated method names: 'Jx2ZCB0GJA', 'lIdZsCPS8i', 'quBZ3xihxO', 'HHqZLogvvs', 'mUhZHOrfvP', 'HNvZFmDqR2', 'z7WZlFD8PK', 'zb6ZaYP3tj', 'OHdZBb23bT', 'kYRZKwGf6k'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, JJb8kXkICK3pIBXBB0.cs	High entropy of concatenated method names: 'pYmrvFuysl', 'MoprJWrUGd', 'DVnr4XJLnH', 'HwCrCSNyJb', 'n6CrsNWmUj', 'nA0rLcLism', 'LTWrHhDAtV', 'v91Z79LMhy', 'lk3ZiGCxOD', 'bobZEHmpZ6'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, qQScs3vgL2JPV0BlNn.cs	High entropy of concatenated method names: 'I4BJRHkLFf', 'espJCkcJKB', 'SxTJsMQMWA', 'vn1J3UXJMk', 'TDgJLHgDXj', 'MDfJHdD8qw', 'ybhJFeyVKY', 'r6WJluVoZJ', 'WvAJaxcUNU', 'HrnJBy3FXF'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, AT9mo5CRrR31EOXuft.cs	High entropy of concatenated method names: 'ajjFQf38Jr', 'DYEF1bc28Y', 'L8CFIBa0Ab', 'guRFWNUsFp', 'DVDFkIia2I', 'WeQFTJKhWv', 'wLiFqR9TW9', 'GQAFjNK0OD', 'PQyFPHvPiX', 'S0hFVhZqMQ'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, YhrWFwjFek2yOMLhRfX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tPZ5XwdcQE', 'f7c5pFj672', 'oqG5mrggd0', 'N6A503Ipho', 'H9A5ty4RFU', 'jE658UviKO', 'Cjk57EeFIo'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, LCiZcv8cfTBdLr9rRi.cs	High entropy of concatenated method names: 'DnEIT2Fbo', 'xIJWWIYv2', 'hKnTW9wcc', 'VLVqFSFLG', 'qJWPx3s7K', 'KkOVSQgLq', 'aFWJV7dmrjcai55921', 'HgJ01DsMW1uoOm4oXE', 'LlbZi1Kxr', 'QFk51DQb0'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, dHqJ02jqwviMq4WJmrL.cs	High entropy of concatenated method names: 'E1MrQITNWG', 'aqFr19C4Uy', 'q97rIib9tI', 'NNMrWHLLcU', 'NB2rkdTZMO', 'XVkrTXYG7R', 'zmerqLpj4c', 'iSUrjRpnC2', 'ccTrPn82tj', 'K9lrVCilIG'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, KWGj67pSWYgtEm4Htu.cs	High entropy of concatenated method names: 'Dispose', 'WuqvEL6Ib1', 'fm7bYOo8CK', 'FNvAAAZjq3', 'uAhvUi7Tag', 'hGuvz3EmyH', 'ProcessDialogKey', 'MM7buCBvVV', 'J5DbvcMmiM', 'Wl7bbmZM4T'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, hwt56m01NN1EHbZEtx.cs	High entropy of concatenated method names: 'ogMHmNWSVJ', 'kchH0nehqU', 'rGHHtGvE4x', 'ToString', 'wpuH8Sf0Bm', 'Xa0H7vrP3X', 'AiyCAi5fQkKUdLhqPAx', 'lUeont5Y0Ojw5TJ74PV', 'UPaak154kYCUbDZVGkh'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, PZg3iXf4RmL1S8LlAY.cs	High entropy of concatenated method names: 'FpfFCNGCOx', 'goYF3r9eR2', 'LyuFHN2e9x', 'i1xHUH8yMP', 'VdIHzogHBG', 'm18Fu0Nnxt', 'TE0Fvm6StH', 'oOgFbNb01V', 'SX7FJpLhT2', 'GqkF43TrUr'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, dtF8SP3TSfjKU2xINg.cs	High entropy of concatenated method names: 'C443WEbYGi', 'r8W3TcGYeJ', 'ioc3jo33ta', 'Qdl3PZLLnJ', 'Wvl3we8mN7', 'nqH3xMEylE', 'hS63GOtTNt', 'Ntq3ZKYPet', 'Nv63r0vx2q', 'n3T35XMI3V'
Source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, EAO5pb4nl8MQbmWoDv.cs	High entropy of concatenated method names: 'POEGBpZ35U', 'CPBGKQGY6J', 'ToString', 'C0OGCbM3Pm', 'RueGs1HihA', 'gnlG33jHbR', 'KEyGLrsQxv', 'rIIGHib5Hg', 'AvQGFeAwCb', 'L0VGlOWyRg'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 6156, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 16E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 33F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 53F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 5AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 6AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 6BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 7BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: A630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: B630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: BAC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: CAC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Window / User API: threadDelayed 847			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Window / User API: threadDelayed 6329			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 6524	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7288	Thread sleep count: 847 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7288	Thread sleep count: 6329 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -96779s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -96672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -96547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -96437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -96328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -96219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97218	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97109	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 96779	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 96547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 96437	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 96328	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 96219	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SecuriteInfo.com.Heur.18737.25106.exe, 00000004.00000002.3281121500.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3282091389.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3282091389.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 6156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 4256, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3282091389.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 6156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 4256, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.SecuriteInfo.com.Heur.18737.25106.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.50cdcb0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.4fd5070.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Heur.18737.25106.exe.5051690.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3282091389.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3282091389.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 6156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.18737.25106.exe PID: 4256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	32 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Heur.18737.25106.exe	49%	Virustotal		Browse
SecuriteInfo.com.Heur.18737.25106.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
SecuriteInfo.com.Heur.18737.25106.exe	100%	Avira	HEUR/AGEN.1307581
SecuriteInfo.com.Heur.18737.25106.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.elec-qatar.com	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://download.alegsoftware.ga/ws_switches/contatore/ltromatic.ttf	0%	Avira URL Cloud	safe
http://mail.elec-qatar.com	0%	Avira URL Cloud	safe
http://mail.elec-qatar.com	3%	Virustotal		Browse
https://download.alegsoftware.ga/ws_switches/contatore/ltromatic.ttf	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.elec-qatar.com	50.87.139.143	true	true	3%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.elec-qatar.com	SecuriteInfo.com.Heur.18737.25106.exe, 00000004.00000002.3282091389.0000000002C26000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Heur.18737.25106.exe, 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://fsf.org/	SecuriteInfo.com.Heur.18737.25106.exe	false		high
https://www.gnu.org/licenses/why-not-lgpl.html	SecuriteInfo.com.Heur.18737.25106.exe	false		high
https://download.alegsoftware.ga/ws_switches/contatore/ltromatic.ttf	SecuriteInfo.com.Heur.18737.25106.exe, 00000000.00000002.2033191147.00000000033FA000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.gnu.org/licenses/	SecuriteInfo.com.Heur.18737.25106.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.87.139.143	mail.elec-qatar.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1414901
Start date and time:	2024-03-25 09:35:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Heur.18737.25106.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 46 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:35:58	API Interceptor	36x Sleep call for process: SecuriteInfo.com.Heur.18737.25106.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
50.87.139.143	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Get hash	malicious	AgentTesla	Browse
	NEW ORDER 98540-0.exe	Get hash	malicious	AgentTesla	Browse
	Documents of shipment 3-2024.exe	Get hash	malicious	AgentTesla	Browse
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla	Browse
	Order 19A20060.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Proforma Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Variant.Lazy.463632.16595.14067.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	New order.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Quotation R2100131410.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.elec-qatar.com	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	NEW ORDER 98540-0.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	Documents of shipment 3-2024.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	Order 19A20060.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	Proforma Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SecuriteInfo.com.Variant.Lazy.463632.16595.14067.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	New order.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	Quotation R2100131410.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	SecuriteInfo.com.Win32.PWSX-gen.23449.29887.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	file.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse	192.185.16.114
	SecuriteInfo.com.Win64.PWSX-gen.371.14469.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	https://duchessgarden.sn/	Get hash	malicious	Unknown	Browse	162.241.27.25
	DHL STATEMENT OF ACCOUNT - 1003657363.exe	Get hash	malicious	AgentTesla	Browse	50.87.195.61
	wn1gncGy2T.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse	192.185.16.114
	https://se-sec-cru-sec-rity.linkpc.net/	Get hash	malicious	HTMLPhisher	Browse	96.125.163.17
	https://seeeee-rcurr--cu---ty.linkpc.net/	Get hash	malicious	HTMLPhisher	Browse	96.125.163.17
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	HTMLPhisher	Browse	192.185.189.216
	invite.hta	Get hash	malicious	Unknown	Browse	162.241.169.194

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.820249466806255
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Heur.18737.25106.exe
File size:	793'600 bytes
MD5:	256ab4b69efe3560e3589e6d7c0d54d5
SHA1:	b138a1744e1030a7bccf18c0d30bef2525be3176
SHA256:	d5af1b5ed5eeca90dc835ed26ffc8a8854890eeefa32aacaa094b5d606d4edda
SHA512:	868d19e9f85eb602af6281f7f48604abb256971df9d72deb381b933cd84039a12fb4158e3ae0227e4c718bf4e2f51adb58e9d305754d70d308c55466aa1381c6
SSDEEP:	12288:sAQK1BxgC74CMwbQScLYiDMzBXcU1lBIWyX7tQMwkh4fb2gC4GhgeUns0Q0D93IF:lVbFRvckiozBDDBIWye2gVGhgPns
TLSH:	87F4DFAD760072EFC45BCA72DAA92C64F75174B7431BD203A05301ACAA1DA9BCF255F3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0............../... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4c2fce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD2E4B502 [Fri Feb 13 10:25:06 2082 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2f80	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc0fd4	0xc1000	b8893752f1113ff59ff70b1e3079d501	False	0.8670066082415803	data	7.82806191300002	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc4000	0x630	0x800	99134aa04a91a5c6ff0a23b3a9df6e95	False	0.33642578125	data	3.486962854321601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0xc	0x200	4d28466b59bd2b8bc85d243877b86e54	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc40a0	0x3a0	data			0.41810344827586204
RT_MANIFEST	0xc4440	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 09:36:02.698775053 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:02.878364086 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:02.878454924 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:03.490273952 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:03.492693901 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:03.672631025 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:03.675710917 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:03.855801105 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:03.856659889 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:04.077027082 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:06.154989004 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:06.155220032 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:06.336791039 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:06.336931944 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:06.336950064 CET	587	49708	50.87.139.143	192.168.2.5
Mar 25, 2024 09:36:06.337017059 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:06.342278957 CET	49708	587	192.168.2.5	50.87.139.143
Mar 25, 2024 09:36:06.521899939 CET	587	49708	50.87.139.143	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 09:36:02.479877949 CET	57874	53	192.168.2.5	1.1.1.1
Mar 25, 2024 09:36:02.692198038 CET	53	57874	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2024 09:36:02.479877949 CET	192.168.2.5	1.1.1.1	0x8cb7	Standard query (0)	mail.elec-qatar.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 25, 2024 09:36:02.692198038 CET	1.1.1.1	192.168.2.5	0x8cb7	No error (0)	mail.elec-qatar.com		50.87.139.143	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 25, 2024 09:36:03.490273952 CET	587	49708	50.87.139.143	192.168.2.5	220-box2248.bluehost.com ESMTP Exim 4.96.2 #2 Mon, 25 Mar 2024 02:36:03 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Mar 25, 2024 09:36:03.492693901 CET	49708	587	192.168.2.5	50.87.139.143	EHLO 123716
Mar 25, 2024 09:36:03.672631025 CET	587	49708	50.87.139.143	192.168.2.5	250-box2248.bluehost.com Hello 123716 [102.165.48.43] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Mar 25, 2024 09:36:03.675710917 CET	49708	587	192.168.2.5	50.87.139.143	AUTH login bW9oYW1tZWQuYWJyYXJAZWxlYy1xYXRhci5jb20=
Mar 25, 2024 09:36:03.855801105 CET	587	49708	50.87.139.143	192.168.2.5	334 UGFzc3dvcmQ6
Mar 25, 2024 09:36:06.154989004 CET	587	49708	50.87.139.143	192.168.2.5	535 Incorrect authentication data
Mar 25, 2024 09:36:06.155220032 CET	49708	587	192.168.2.5	50.87.139.143	MAIL FROM:<mohammed.abrar@elec-qatar.com>
Mar 25, 2024 09:36:06.336931944 CET	587	49708	50.87.139.143	192.168.2.5	550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

Target ID:	0
Start time:	09:35:58
Start date:	25/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"
Imagebase:	0xfe0000
File size:	793'600 bytes
MD5 hash:	256AB4B69EFE3560E3589E6D7C0D54D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2033882136.0000000004DCE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:35:59
Start date:	25/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"
Imagebase:	0x230000
File size:	793'600 bytes
MD5 hash:	256AB4B69EFE3560E3589E6D7C0D54D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:35:59
Start date:	25/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Heur.18737.25106.exe"
Imagebase:	0x760000
File size:	793'600 bytes
MD5 hash:	256AB4B69EFE3560E3589E6D7C0D54D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3282091389.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3280543874.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3282091389.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3282091389.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	191
Total number of Limit Nodes:	20

Executed Functions

Function 016E32E9 Relevance: 2.9, Strings: 2, Instructions: 372
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ln, xrefs: 016E3582
Ln, xrefs: 016E357B

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Ln$Ln
API String ID: 0-2613154330
Opcode ID: 613555620799ada68943f564ba9917729875ab56c3b7ed369cc67688855acd5e
Instruction ID: af640b0e5ffdae910e764f8e6eb312f2daa7349ac28de52d33ea12440bc4c46f
Opcode Fuzzy Hash: 613555620799ada68943f564ba9917729875ab56c3b7ed369cc67688855acd5e
Instruction Fuzzy Hash: 67F16A74D0620ACFCB15CFA5CA898AEFBF2BF88301B14C659C515AB355D735AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016E3350 Relevance: 2.9, Strings: 2, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ln, xrefs: 016E3582
Ln, xrefs: 016E357B

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Ln$Ln
API String ID: 0-2613154330
Opcode ID: 343770c5500b440a9f87747d0593ac6050b3ac74ef9eae3f727f6d6b0db95a05
Instruction ID: 782330f6bea476d5a9bf7b4b78247610857280a6c7d41032df1fbd90fd685f0b
Opcode Fuzzy Hash: 343770c5500b440a9f87747d0593ac6050b3ac74ef9eae3f727f6d6b0db95a05
Instruction Fuzzy Hash: CBE1577490620ACFCB05CFA5CA898AEFBB2BF88301B14C659C515AB355D735EA42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016E3428 Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ln, xrefs: 016E3582
Ln, xrefs: 016E357B

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Ln$Ln
API String ID: 0-2613154330
Opcode ID: 3fef4f272b0115f862da4fff966db8ba9dba21f400209b0b8a3ef45eef603ffc
Instruction ID: a71561c31602cf9e13c931789ea430813e7a445411473bc494cc4a069104a272
Opcode Fuzzy Hash: 3fef4f272b0115f862da4fff966db8ba9dba21f400209b0b8a3ef45eef603ffc
Instruction Fuzzy Hash: 08C14774D0221ADFCB05CF99C9898AEFBB2FF88301B149659D515AB354D734EA82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 016E1370 Relevance: 2.8, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 016E1479
Te]q, xrefs: 016E1624

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 9554ae7e0a393ef62c3d0faa00d5037a72cbbda11ca59fddb1ab92f59ec3e347
Instruction ID: 9c77fe74bc842ffd7a77d14a73a8e1e3789ff25f4ef35530385a558f9d6d61d1
Opcode Fuzzy Hash: 9554ae7e0a393ef62c3d0faa00d5037a72cbbda11ca59fddb1ab92f59ec3e347
Instruction Fuzzy Hash: DDB14474E053098FCB18CFA9C9946AEFBF2FF89310F14852AD815AB324D735A906DB50

Uniqueness

Uniqueness Score: -1.00%

Function 016E1410 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 016E1479
Te]q, xrefs: 016E1624

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: d7c636ad2e43d45985a79db48321cf95c86290297738196d2625e176221de584
Instruction ID: 0a293605946b5814496cca55de0ef2d6c6c726b37b222699113af866219a8765
Opcode Fuzzy Hash: d7c636ad2e43d45985a79db48321cf95c86290297738196d2625e176221de584
Instruction Fuzzy Hash: 5981B074E01219CFDB08CFA9C994AAEBBF2BF89310F24952AD515BB364D7309906CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09F70448 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041857882.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f70000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36e938947656715bb3c75eb82124124b991bf28d8e8aa1cb0d44ee2ecf23c97
Instruction ID: 7f9192774ee770b087c6412b12b43450bb8457464080831a382bb69f35f1777a
Opcode Fuzzy Hash: e36e938947656715bb3c75eb82124124b991bf28d8e8aa1cb0d44ee2ecf23c97
Instruction Fuzzy Hash: C8228A31B013049FDB19DF69C854BAEBBF6AF89300F2844AAE5059B3A4CF75E901CB51

Uniqueness

Uniqueness Score: -1.00%

Function 016E1B82 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d2ebddb6826c9d47899c0dc56a158e99855a16608f6d42ffde5a44c95fccb7
Instruction ID: 497029a0914b79fe7a6dab5e906f9f3b23b2e9f5c615fd5cacb52608db4ca6d3
Opcode Fuzzy Hash: 43d2ebddb6826c9d47899c0dc56a158e99855a16608f6d42ffde5a44c95fccb7
Instruction Fuzzy Hash: 73515B74D052098FCB08CFAAD9446AEFBF2BF89300F14D16AD419AB255D7345A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 016E2581 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327954d5893238d799935473d487ab61e70b341acc804894ab621de816381450
Instruction ID: 8e537b2ec71dddbcee9227a48f5b6b1954f63d620902ec3f16c15f23f142c2aa
Opcode Fuzzy Hash: 327954d5893238d799935473d487ab61e70b341acc804894ab621de816381450
Instruction Fuzzy Hash: 5E5128B4D012688FDB24CFA5CD947DDBBF6BF89300F1482AAD409AB254CB345A96CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09BB1315 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f90ac03a0a6b926cca788018de40c757f9da4af21e515f0ed3ce57cf677ad93
Instruction ID: 6e2ee9bcebf993fd156609f30b4a43f8f35ef78998a7fbc31ede3367454d1d87
Opcode Fuzzy Hash: 6f90ac03a0a6b926cca788018de40c757f9da4af21e515f0ed3ce57cf677ad93
Instruction Fuzzy Hash: FC41ACB4D05248DFDB10DFA9C584AEEFBF1BB09310F20906AE419BB264D774A944CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09BB1320 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1328d630ad58306a86504237e4646045f8a0d5e37249270464d1b3413628f4
Instruction ID: 4e5b4a40813163100cf0408bbbecbab1e294c0928e6e0571a45830b2acd9744f
Opcode Fuzzy Hash: 5a1328d630ad58306a86504237e4646045f8a0d5e37249270464d1b3413628f4
Instruction Fuzzy Hash: 8C41AAB4D012089FDB10CFA9C584AEEFBF1FB09310F20906AE418BB290D7B4A944CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016E08D1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c118182c984ea328a80775d16f6c6057910f4062c141c4c3f33b58a6003678
Instruction ID: 214c863061838e247692d20b25a8f51f8fc29823fb8c4331782bb1b3074f82a2
Opcode Fuzzy Hash: b1c118182c984ea328a80775d16f6c6057910f4062c141c4c3f33b58a6003678
Instruction Fuzzy Hash: 45211D71E056188BEB18CF6BDD4069EFBF7AFC9300F04C1B6C418A6224EB3419468F51

Uniqueness

Uniqueness Score: -1.00%

Function 09BBCCFC Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09BBCFCF

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 14a3d77a4abfa1fcd685b206915be471baf60c52117ae5415460c4a6a2a0c64f
Instruction ID: 81423474c0c704fce11b78eafb3c0764b2f1b57e99120b323b47bbb4d1d07d6f
Opcode Fuzzy Hash: 14a3d77a4abfa1fcd685b206915be471baf60c52117ae5415460c4a6a2a0c64f
Instruction Fuzzy Hash: FBC11771D002598FDB24CFA8C841BEDBBB1FF49310F0095AAE459B7290DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09BBCD08 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09BBCFCF

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0074c04a829297f933e5029e402a3f9058c303405b112d021ccd8633524a4a33
Instruction ID: ce0f04300ae15499194c7df90dba1bcc60de414581880887116a527355670881
Opcode Fuzzy Hash: 0074c04a829297f933e5029e402a3f9058c303405b112d021ccd8633524a4a33
Instruction Fuzzy Hash: 30C11870D002598FDB24CFA8C841BEDBBB1FF49310F0095A9E459B7290DBB49A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 016EC4D0 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016EDDD1

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e509bc63c5a906e59af11ad9c3ba3cf1478d635b05fac29483867e9c05763eb5
Instruction ID: 976946ca4c7fb5bc2583dc51806fd6cbfaa32b3607ff7c347f20fd0b1ed597a7
Opcode Fuzzy Hash: e509bc63c5a906e59af11ad9c3ba3cf1478d635b05fac29483867e9c05763eb5
Instruction Fuzzy Hash: D551E3B1D00219CFDB20DFA9C944BDEBBF5BF49300F1081AAD509AB251DB756A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 09BBC541 Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09BBC61B

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e1a353759b2d4bc08eab7147448a3f6c7f44bcaeebcbfdebc0517dc78327d3ea
Instruction ID: ebf984ef21f285afdc6499f7cb28b51296fbd6db4010719d8f34d088240e4d59
Opcode Fuzzy Hash: e1a353759b2d4bc08eab7147448a3f6c7f44bcaeebcbfdebc0517dc78327d3ea
Instruction Fuzzy Hash: E8419BB5D012589FCB00CFA9D984AEEFBF1BF49310F24942AE419B7250D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBC548 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09BBC61B

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: be114f8509bf0158ff3f8c7811c644f3563242eb3466f90ceb4a8901bd835ac7
Instruction ID: ecdc34fa34aa70f6a4fc1ff1d61c511e3df092fba08222110a4fd2921ff9d22c
Opcode Fuzzy Hash: be114f8509bf0158ff3f8c7811c644f3563242eb3466f90ceb4a8901bd835ac7
Instruction Fuzzy Hash: 97419BB5D012589FCB00CFA9D984AEEFBF1BF49310F10942AE419B7250D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBCAD0 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09BBCB8A

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 16efc8b7d9a0f8756f4c7144fb01e52434791e813e04ca907da32a3f924cc9c9
Instruction ID: 586e005ce5cbfb79b7b13d7c79edb85c3bb773d33c4d134c546ff57b23669985
Opcode Fuzzy Hash: 16efc8b7d9a0f8756f4c7144fb01e52434791e813e04ca907da32a3f924cc9c9
Instruction Fuzzy Hash: 0341AAB9D002589FCF10CFA9D984AEEFBB1BF49310F14942AE819B7250D734A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBCAD8 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09BBCB8A

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7fd44b6b07a0990a8b3a55b2d55998b13e24873539637866acf6b26a321bb9b0
Instruction ID: 0d7fb113abff84de663da49506e112a44ae97c815f2d9d1ef81763b443ba738e
Opcode Fuzzy Hash: 7fd44b6b07a0990a8b3a55b2d55998b13e24873539637866acf6b26a321bb9b0
Instruction Fuzzy Hash: BF41ABB9D002589FCF10CFA9D980AEEFBB1BF09310F10942AE819B7250D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBC420 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09BBC4D2

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 559b72d35d5738d74ccf69eaeb6f9b80677b32bcd7b6399f3fc1aa8f85476144
Instruction ID: 864c829aae63c953b4c92ca1882e164f348d2bfa0a7d5f87a6da3a7f7128688f
Opcode Fuzzy Hash: 559b72d35d5738d74ccf69eaeb6f9b80677b32bcd7b6399f3fc1aa8f85476144
Instruction Fuzzy Hash: 3B3199B8D002589FCF10DFA9D981AEEBBB1BF49310F10942AE815BB250D775A941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBC428 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09BBC4D2

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1148b52e1f96b6c0b74daf0294a9375888b8738d074fac2285db336cb2315a90
Instruction ID: 0a5775a47c275aa21df95d58338434515bc80d9500a5659bae1d107f7f213ceb
Opcode Fuzzy Hash: 1148b52e1f96b6c0b74daf0294a9375888b8738d074fac2285db336cb2315a90
Instruction Fuzzy Hash: 743188B9D002589FCF10CFA9D980AEEFBB5BF49310F10942AE815BB250D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBBEC1 Relevance: 1.6, APIs: 1, Instructions: 95threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 09BBBF77

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 30049e210cdaa803bd431d496c0157e20f253e52a9419935d8af6152359c7a4a
Instruction ID: 501d0d1fdfc467bcbaae4ff8a9dc44dcb5fce1c30b6b447aa1b39381a56604fd
Opcode Fuzzy Hash: 30049e210cdaa803bd431d496c0157e20f253e52a9419935d8af6152359c7a4a
Instruction Fuzzy Hash: DF41ABB5D012589FCB10DFA9D984AEEBBF1BF49310F24802AE419B7250D778A985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 016E82FA Relevance: 1.6, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 016E83A7

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0151b58bb74f2284ba3707289ba83b3b2c223e9b02453084f84e35dbcb74d98d
Instruction ID: 48f341a59b810125cc2a6cb22faa2adf7aa6a4010a7734d96592c9504790108d
Opcode Fuzzy Hash: 0151b58bb74f2284ba3707289ba83b3b2c223e9b02453084f84e35dbcb74d98d
Instruction Fuzzy Hash: DB319AB9D012589FCB10CFA9D584AEEFBF5BF09310F24906AE814B7220D335A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBBEC8 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 09BBBF77

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1067d24191115f66565508ef7c6cf6085d9491638474ca57da62761f4ab2e6b4
Instruction ID: 50ca627955dda50c817a7d30abd35f26ceafbe8dff9093dc6b5ac816881bf1c0
Opcode Fuzzy Hash: 1067d24191115f66565508ef7c6cf6085d9491638474ca57da62761f4ab2e6b4
Instruction Fuzzy Hash: A231BBB5D012589FCB10DFAAD984AEEFBF1BF49310F14802AE419B7250D778A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 016E8300 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 016E83A7

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7f4c6c5f131b64f669660efae60422661708cd87983782af25ed82d9eca44087
Instruction ID: 4573b82183a5b057237dc4041748982cf0f6de009d4825988bb5902b18362775
Opcode Fuzzy Hash: 7f4c6c5f131b64f669660efae60422661708cd87983782af25ed82d9eca44087
Instruction Fuzzy Hash: 513179B9D052589FCB10CFA9D984ADEFBF5BF19310F14902AE818B7220D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BB5980 Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,00000000), ref: 09BBF613

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6bf3771c68aced1749cad1cd15c8aefb32ac547b88ed6486f59242b23edc5a41
Instruction ID: 3847e584e8cb69830ff14a8787dbd8f8bfbd280f231f877195245ba99f1e1388
Opcode Fuzzy Hash: 6bf3771c68aced1749cad1cd15c8aefb32ac547b88ed6486f59242b23edc5a41
Instruction Fuzzy Hash: 223199B8D002489FCB10DFA9D984AEEFBF4EB09310F10905AE819BB320D375A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09BBF570 Relevance: 1.6, APIs: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,00000000), ref: 09BBF613

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7e4d97e44e2dcfb058acc7fdd56d68f652bda6d5bbabb0455f29498949b964f3
Instruction ID: cff08f193c9136fa6d09a0afbc3c112ced78bf7ab457911b9cea88d4fd67db0f
Opcode Fuzzy Hash: 7e4d97e44e2dcfb058acc7fdd56d68f652bda6d5bbabb0455f29498949b964f3
Instruction Fuzzy Hash: 003177B9D012489FCB10CFA9E984ADEFBF5AB09320F14905AE819BB360D375A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09BBF589 Relevance: 1.6, APIs: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,00000000), ref: 09BBF613

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0ac9b03e22e5e7e0762fb1f7033000f5da3b28988fa6854172e2465c275be316
Instruction ID: 70e9bf966444bb15826f913b0f11773223aed17fd51795fadefab828c8cd76e7
Opcode Fuzzy Hash: 0ac9b03e22e5e7e0762fb1f7033000f5da3b28988fa6854172e2465c275be316
Instruction Fuzzy Hash: 923166B9D052489FCB10CFA9E580AEDFBF1AF19310F24905AE819BB320D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09BBBDD0 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 09BBBE56

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e640367d2b43159201c02a4dde44dab8324a11bb57030a9d36fc411239c13327
Instruction ID: 0daaaae0ffabc1d633a9c45bb637ca3d04ea37270f6c1d78ccaa0d0dbb0c5e58
Opcode Fuzzy Hash: e640367d2b43159201c02a4dde44dab8324a11bb57030a9d36fc411239c13327
Instruction Fuzzy Hash: A531CBB4D002189FCB14CFA9D584AEEFBB5BF49320F14846AE419B7350D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 09BBBDD8 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 09BBBE56

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c991fea8c165ec8b1f5dcd80cdd3637cfb6705b25b38af0a6bc1b735303132e1
Instruction ID: e9265ff121e7d55554c8cdf4b805ac870b28ea3ef6aa5d962326262ac546263f
Opcode Fuzzy Hash: c991fea8c165ec8b1f5dcd80cdd3637cfb6705b25b38af0a6bc1b735303132e1
Instruction Fuzzy Hash: D631CBB4D002189FCB10CFA9D580AEEFBB4BF49310F10842AE419B7250C774A841CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 09F71040 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 09F710BB

Memory Dump Source

Source File: 00000000.00000002.2041857882.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f70000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f534131b38a57159fe15c6e4f8222c51440d8f2ac5dd16b942834ecffe290e9e
Instruction ID: 40eaedf2fc79ebd2090af9bfb26471986c37ab49ff1809189a5748f8518d3a2d
Opcode Fuzzy Hash: f534131b38a57159fe15c6e4f8222c51440d8f2ac5dd16b942834ecffe290e9e
Instruction Fuzzy Hash: A431BBB9D00258DFCB10CFA9D584ADEFBF4AB08314F24805AE855B7310D339AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09F71048 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 09F710BB

Memory Dump Source

Source File: 00000000.00000002.2041857882.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f70000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1ef1f91756f029c981613206e200fcb567c0ca80f48574617af3497295896f4d
Instruction ID: ba34874344c9951feebedc28decf20a1a932e1d8101607d89d62686f554bc479
Opcode Fuzzy Hash: 1ef1f91756f029c981613206e200fcb567c0ca80f48574617af3497295896f4d
Instruction Fuzzy Hash: 4531ACB5D042589FCB10CFA9D584ADEFBF4AF08310F14805AE815B7350D379AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0168D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032191549.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c473abe49bc0f9397a9fd04534eb4ae236352a2315700ede70b53bb2c891be58
Instruction ID: 426c783fab44f6638485cc35c74b5d1bca6a45acef5aedfa72c98337d9427648
Opcode Fuzzy Hash: c473abe49bc0f9397a9fd04534eb4ae236352a2315700ede70b53bb2c891be58
Instruction Fuzzy Hash: F7210671500240DFDB15EF58D9C0F26BF65FB88318F20C66AD9090B396C336D416C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 0169D1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032219731.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83982ad03b19621a10d960af0ffa631ecb454331d8ad9a93a432ba370d8b785
Instruction ID: 36f474213c39511f2bbdeb369a3b8d3d6924bd9f787d43fe0b1c385271279552
Opcode Fuzzy Hash: c83982ad03b19621a10d960af0ffa631ecb454331d8ad9a93a432ba370d8b785
Instruction Fuzzy Hash: 7121F5715443049FDF05DF98D9C0B16BB69FB84324F20C5BDDA094B396C37AD406CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0169D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032219731.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3133582eb52a45096093ab995e272b6bb8a3c2c80cd1c7cd9d316f792dd580f8
Instruction ID: cf948148d0bc5d3c3fbf77094b0b8a0c76cc8dfe0bddc0c6adf47685ab86e07b
Opcode Fuzzy Hash: 3133582eb52a45096093ab995e272b6bb8a3c2c80cd1c7cd9d316f792dd580f8
Instruction Fuzzy Hash: 80210071604200DFDF15DFA8D984B26BF69FB88354F20C579D90A0B396C33AD407CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0169D006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032219731.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c243d87846a209092497f1b85f6d88016745191cb4d1e658ab64446f17b9557a
Instruction ID: cf285cfb3fcb6c70a4068f0e987ebdf55d2d598ffbc21c445d2c1afe8787f2dc
Opcode Fuzzy Hash: c243d87846a209092497f1b85f6d88016745191cb4d1e658ab64446f17b9557a
Instruction Fuzzy Hash: 7F219F755083809FDB02CF64D994B11BFB5FB46314F24C5EAD8498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0168D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032191549.000000000168D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0168D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_168d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 9d93f731ce91a53eac2cf3f840078365a5c6fbdc5c3d6abe753cee4512ded2d7
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: BD11DF72404280DFCB02DF54D9C4B16BF71FB88314F24C6AAD9490B656C336D45ACBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0169D1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032219731.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_169d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 1cf95848da4b463b4faf4b2560da97da1688d0ffd3cd857edc0afb767639760c
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 66119D75504280DFDB06CF94D9C4B15BFA2FB88324F24C6A9D9494B796C33AD44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 016E5710 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

vp}Q, xrefs: 016E576A
W[S%, xrefs: 016E57C3

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: W[S%$vp}Q
API String ID: 0-355715107
Opcode ID: 6d21c050b580e05c43ad76d181c1f3a68091127ac574cbd2754a6c9c372ad979
Instruction ID: 7a91454a459f7ceefa1969b7d8c2bc1f9da56487b7b198f3ad17ba6bd52872f6
Opcode Fuzzy Hash: 6d21c050b580e05c43ad76d181c1f3a68091127ac574cbd2754a6c9c372ad979
Instruction Fuzzy Hash: 9461D774E15219CFCF04CFA9C9848EEFBF2FB88314F28956AD406B7214D77499428B55

Uniqueness

Uniqueness Score: -1.00%

Function 016E4E60 Relevance: 2.7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

ji5q, xrefs: 016E4F79
ji5q, xrefs: 016E4F87

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ji5q$ji5q
API String ID: 0-2016025989
Opcode ID: a4f427e4870af49e51f305d49a17c893aa70c57dcde6208bc1e43ebbf89bcf69
Instruction ID: 6e983324c430b5f695ac878c07054a65ca9adc8d7b4938cd60ec10b2fccb0e12
Opcode Fuzzy Hash: a4f427e4870af49e51f305d49a17c893aa70c57dcde6208bc1e43ebbf89bcf69
Instruction Fuzzy Hash: 1D71C3B4D0620ADFCB04CFA9C9849AEFBF2BF88350F148659D415AB314D734A982CF95

Uniqueness

Uniqueness Score: -1.00%

Function 016E5700 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

vp}Q, xrefs: 016E576A
W[S%, xrefs: 016E57C3

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: W[S%$vp}Q
API String ID: 0-355715107
Opcode ID: 38043f46daa3070551b5c54eb6f4f1619f08960f393ab4d13f01b830dc616672
Instruction ID: ad6713fc9ff5c09129156c314ca81d74c865fc383bc79b7c4dae177669e52c21
Opcode Fuzzy Hash: 38043f46daa3070551b5c54eb6f4f1619f08960f393ab4d13f01b830dc616672
Instruction Fuzzy Hash: A461F678E15209CFCF04CFA9CA845EEFBF2FF88214F28956AD406B7214D7349A528B54

Uniqueness

Uniqueness Score: -1.00%

Function 016E4E50 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

ji5q, xrefs: 016E4F87

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ji5q
API String ID: 0-3085614024
Opcode ID: 93c162c8bb341a11fd84343b219c88cfc9af4de62f6bd6d22e5a6aaf7577cd58
Instruction ID: 194faab97da389881c548469a6a8fb89d0dab191a64024c57e23bb852de94b34
Opcode Fuzzy Hash: 93c162c8bb341a11fd84343b219c88cfc9af4de62f6bd6d22e5a6aaf7577cd58
Instruction Fuzzy Hash: 7261D574D0620A8FCB04CFA9C9849AEFFF2BF89210F158656D415EB315D7349942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09BB9E39 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b20a250e6c23f7fe33d667439c798c08921e872ad56eac38f551ec67bd2c94
Instruction ID: 976bc934d560cf1149ba32a2a3e8c6593dd09e8491121c7f524c5972e043f046
Opcode Fuzzy Hash: e2b20a250e6c23f7fe33d667439c798c08921e872ad56eac38f551ec67bd2c94
Instruction Fuzzy Hash: C3E1F874E012198FDB14CFA8C580AAEBBF2FF89315F2481A9D418AB356D771AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09BBA6B8 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada7021c27d3439e98f66db8d637ead1fd57175a2fc61a6dff86c65ee0bf21c0
Instruction ID: 5136a70b144e9a7c33e4061d31f158c1c230811ca9c90de0f1f77c78c0dcfe86
Opcode Fuzzy Hash: ada7021c27d3439e98f66db8d637ead1fd57175a2fc61a6dff86c65ee0bf21c0
Instruction Fuzzy Hash: F6E1F774E002199FDB14CFA9C5809AEBBF2FF89315F24C1AAD418AB356D770A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09BBBFF0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e05a22535db7ad84ea741c764332fe709c298313a140086158382ebd8f8f0d
Instruction ID: dffe956dc0af8f3b26f5e29c64e3be1e4a9531b017033cbc9d4d4af134126418
Opcode Fuzzy Hash: 99e05a22535db7ad84ea741c764332fe709c298313a140086158382ebd8f8f0d
Instruction Fuzzy Hash: 0DE1F774E001198FDB14CFA9C5809AEBBB2FF89315F24C1A9E458AB356D770AD42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09BBA290 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e793ec113c7ec764173559c2a1e2c09b3138d42c68cc2d8a121870e821565e
Instruction ID: 908183e5d96d79149fe8552cbb2f24f917c14646cabdd210e0530359d71b8f7e
Opcode Fuzzy Hash: c5e793ec113c7ec764173559c2a1e2c09b3138d42c68cc2d8a121870e821565e
Instruction Fuzzy Hash: 70E1D674E001198FDB14CFA9C5809AEBBF2FF89315F2481A9D419AB356DB70AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09BBC6A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69a2cabe4915adc0a35b474285aa600c0de71ec1959225c846ee3ef85538eef
Instruction ID: 4a1b7cd8434f02054f8a10d40da0765e02f4ae66fa07f0a9955ebfd20cd9d9eb
Opcode Fuzzy Hash: e69a2cabe4915adc0a35b474285aa600c0de71ec1959225c846ee3ef85538eef
Instruction Fuzzy Hash: 14E10874E001198FDB15CFA9C5809AEBBB2FF89315F2481A9D458AB356D770AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 09BB3448 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cd7e31b6ac02ba9247cd03825f06a15c7b38a3dfc79893e2044b1a2d9f5d04
Instruction ID: c2fbe5222982fca2cdce5e0f8e8b2c5c62b27b2701d88c4e03c1a0ff2e90d210
Opcode Fuzzy Hash: 66cd7e31b6ac02ba9247cd03825f06a15c7b38a3dfc79893e2044b1a2d9f5d04
Instruction Fuzzy Hash: 68B1C1B0D09228DFDF29CFA5C8447EDBBF2BB49314F0091AAD409AB291D7B54A85CF01

Uniqueness

Uniqueness Score: -1.00%

Function 09BB1E80 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68c0b0b304741c60ccb270d68cb7d27ab61e5a9cea9eb6a3990957213a97464
Instruction ID: f6b5a2d644dfb680960b5a7e9a5ae1895db6f822d3a177ac0f1ede12f3574823
Opcode Fuzzy Hash: e68c0b0b304741c60ccb270d68cb7d27ab61e5a9cea9eb6a3990957213a97464
Instruction Fuzzy Hash: E2D11731C2075A8ACB01EF64D954A9DB7B1FFA5300F50C79AD40977221EB74AECACB91

Uniqueness

Uniqueness Score: -1.00%

Function 09BB3458 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a14d46410c1b220938164d0f5aeecd8f1b4a1c1d5b85753f310fd34b353f80f
Instruction ID: 48037f1677360403a2ad76f051ff296e411299d9d88efa4f2b9a57fb23c89a9a
Opcode Fuzzy Hash: 3a14d46410c1b220938164d0f5aeecd8f1b4a1c1d5b85753f310fd34b353f80f
Instruction Fuzzy Hash: 03B1AFB4D09228DFDF29CFA5C8447EDBBF2BB49354F0091AAD409AB281D7B54A85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09BB1E90 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766ca6946e1162001360163453d36238ef48670c747b731981302fc234789fa7
Instruction ID: d06161e41089e8adae3e9f9857263c82159067a0f34ea0dc4c1b36fcbfd821b6
Opcode Fuzzy Hash: 766ca6946e1162001360163453d36238ef48670c747b731981302fc234789fa7
Instruction Fuzzy Hash: E9D1F531C2075A8ACB01EF64D954A9DB7B1FFA5300F50C79AD40977220EB74AECACB91

Uniqueness

Uniqueness Score: -1.00%

Function 09BB3A28 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b08a3b0675c398e473f1519b62958fd622a559567d92a7755aa02866215a36
Instruction ID: a91792a2a6622b35998e79d76b501b446791a75c38909890868579cc079954d8
Opcode Fuzzy Hash: a4b08a3b0675c398e473f1519b62958fd622a559567d92a7755aa02866215a36
Instruction Fuzzy Hash: 3E61B374E051199BCB04DFAAC5909AEFBF2FF88310F24D169E419AB355DB31A942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 016E5152 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20749910f256e178fdbb529cf18a8907c205f03ed346698727296fb18ec0ae51
Instruction ID: 1a925f0ac5ecb6d4aa1f8662824ffb574e74db23b6f114f2957c7b4fb0a856cc
Opcode Fuzzy Hash: 20749910f256e178fdbb529cf18a8907c205f03ed346698727296fb18ec0ae51
Instruction Fuzzy Hash: D86149B4E1520A9FDB05CFAAC8845EEFFF2AF89304F14C26AD515AB255D3349642CF90

Uniqueness

Uniqueness Score: -1.00%

Function 09BB3982 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5edab270773a2923eef3a83fd95321de9bbfe336cbd0d6dc89e39f55d37d70
Instruction ID: 7cc1497df8ee73fa9922f8d236fc441d6be68fa9cdab544f584b15f2f6278b46
Opcode Fuzzy Hash: 1d5edab270773a2923eef3a83fd95321de9bbfe336cbd0d6dc89e39f55d37d70
Instruction Fuzzy Hash: 60511B74E062089FCB05DFAAD9805EEBBF2FF89310F14C16AE408AB355D7719946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 09BBC691 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1376c77366ca2e0a84613ca551f55a16eb4ac0b18b97eb062c811937afa40810
Instruction ID: abb0989e00789b85643c3f5e94a52bc57e295f1d90170162801f9c31837307ec
Opcode Fuzzy Hash: 1376c77366ca2e0a84613ca551f55a16eb4ac0b18b97eb062c811937afa40810
Instruction Fuzzy Hash: 1C512A70E002198FDB15CFA9C5805AEFBF2FF89315F24C1AAD458AB256D7309941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016E5960 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3c1b0a3b92ef54e9ca9b204002416266187e7abb0b5696a002a6ff813bd04e
Instruction ID: f4b9f8546a57f511b311fac1af33e012f0861ceac7a051b95e54fbbbb754a061
Opcode Fuzzy Hash: 1d3c1b0a3b92ef54e9ca9b204002416266187e7abb0b5696a002a6ff813bd04e
Instruction Fuzzy Hash: 6B410974E0520ADFDB08CFA9C9855EEFBF2BF89310F24D66AC406AB254D7305A51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 016E5970 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4216183e755764c50e58178b3fb58f25a75b12067051966bd392b977b9adf7a6
Instruction ID: d4f9cfb83e46f37d0ca5671ce14be115b90a5644c44564a70377e017aea4ec5f
Opcode Fuzzy Hash: 4216183e755764c50e58178b3fb58f25a75b12067051966bd392b977b9adf7a6
Instruction Fuzzy Hash: 7A410974E0520ADBDB04CFAAC9855EEFBF2BF89310F24D56AC40ABB254D7345A41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 09BB3A1A Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d272ed00f38ec70d7bace1afa841eb8891d8988f7169bfa6291bd624b8c9607
Instruction ID: a02206c5d651ca451542811cfd9ca9d78a180e0fbc459fe87176a3808d55ef65
Opcode Fuzzy Hash: 9d272ed00f38ec70d7bace1afa841eb8891d8988f7169bfa6291bd624b8c9607
Instruction Fuzzy Hash: DE41E774E056188FDB08DFAAC99059EFBF2FF88310F14C16AD408AB355DB359946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 016E5B59 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294b33b9fd6ed9205d177c2737ececf583d4f24429cfdfcea0f60b550b3750aa
Instruction ID: 1f2e0b48c10f458a9058fb7526cbe46b66747315b5a5ad5ca0168fb456297a00
Opcode Fuzzy Hash: 294b33b9fd6ed9205d177c2737ececf583d4f24429cfdfcea0f60b550b3750aa
Instruction Fuzzy Hash: 65416E71E016588BEB28CF6B8D4439DFBF3AFC9301F14C1BA950CA6225DB300A568F51

Uniqueness

Uniqueness Score: -1.00%

Function 016E5508 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6dfbad92624af720997dabfe3ceaa6743e0946dfc2e3a4b7a4e49e4733247
Instruction ID: f9700c25350a8db4367cecfd662511240c741170c1f01dd7b5566be5b8ad6bb6
Opcode Fuzzy Hash: 65a6dfbad92624af720997dabfe3ceaa6743e0946dfc2e3a4b7a4e49e4733247
Instruction Fuzzy Hash: 9241E6B4E1560A8FCB44CFAAC8845AEFBF2BF88304F14D569C41AF7214D7349A428F94

Uniqueness

Uniqueness Score: -1.00%

Function 016E54F8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032344484.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0be650df4ec871e11d84fc225666c0cd55040df917c0bc46ebab8f073806d32
Instruction ID: 8ec2733f70e3405c4ef7d03359c82ee152cb6da9dfea6738a5874c044d7893a7
Opcode Fuzzy Hash: f0be650df4ec871e11d84fc225666c0cd55040df917c0bc46ebab8f073806d32
Instruction Fuzzy Hash: 8E41F8B4E1560A8FCB04CFA9C9845AEFBF2BF88314F14C56AC515AB254D7349642CF94

Uniqueness

Uniqueness Score: -1.00%

Function 09BB1485 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8590f37375a47df3974222c54739a7cd56f2bf36a3d116c1dca468847d73a5b2
Instruction ID: eb8cc20b83e680f74e6286d9f22a5921862998e82d2e6d412d73d55554bbab89
Opcode Fuzzy Hash: 8590f37375a47df3974222c54739a7cd56f2bf36a3d116c1dca468847d73a5b2
Instruction Fuzzy Hash: 43318DB8D05208EFCB14CFA9D594AEDBBF1BB89360F249169E814BB390D3749941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 09BB1490 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3eb39035948898d0ff35ac1292a786f30aee93b01cd3182df15c41af26a3df6
Instruction ID: 731e8196a2aa755c65959357606677d69a339a8d9e4ea5915cb6d785b2b93555
Opcode Fuzzy Hash: f3eb39035948898d0ff35ac1292a786f30aee93b01cd3182df15c41af26a3df6
Instruction Fuzzy Hash: C8318EB8D05208EFCB14CFA9D494AEEBBF1BB89360F249169E814B7390D3749941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09BB17A5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa22ada02bbcab26d0357eb1ff02f356933f98f0a9c6b7c94421a2b391c46653
Instruction ID: 718f73ac1bbd4f282587e96c46bcfc8d55256db32428423cccbeafeebe8a21f2
Opcode Fuzzy Hash: fa22ada02bbcab26d0357eb1ff02f356933f98f0a9c6b7c94421a2b391c46653
Instruction Fuzzy Hash: 86219274D042099FDB04CFAAD4446EDBBB1FB4A320F24D169E814BB2A0D7748541CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09BB17B0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039efdfc2b0bd57aac337bd36e6fa26017f8dc623de60ba37596f1f806e6770f
Instruction ID: 29cb902b9413a837b91f431fad92f55785e736984b599faa053eb3cb555ce663
Opcode Fuzzy Hash: 039efdfc2b0bd57aac337bd36e6fa26017f8dc623de60ba37596f1f806e6770f
Instruction Fuzzy Hash: BD217F78D042089FDB04CFAAD4546EDBBF1BB49320F10E169E814BB290D7749541CF98

Uniqueness

Uniqueness Score: -1.00%

Function 09BB16DC Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf4cc80ffe275c451d6cd6a62105c6d3aca0ae256d82407eb1824b666c5bf47
Instruction ID: 50218ddb496c938baf7afedad1e793edaebbb0af4d99d217802eccec41375846
Opcode Fuzzy Hash: 2bf4cc80ffe275c451d6cd6a62105c6d3aca0ae256d82407eb1824b666c5bf47
Instruction Fuzzy Hash: B7F09CB5E152089F8F04DFA9D4414EEFBF2AB5A311F10A166D804B7310D33589518F68

Uniqueness

Uniqueness Score: -1.00%

Function 09BB16E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: 383d943dfa6ecc2645028fa5a55496d291542a0477846c4a87719d326fc0dbbb
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: 12F042B5D0520C9F8F04DFAAD5418EEFBF2AB59310F10A16AE814B7310E73599518FA8

Uniqueness

Uniqueness Score: -1.00%

Function 09BBE40F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c78346c2c6a33f1bf9d9da0a6fb53135ecc54b1d2bc50bcc8d38ac73d90d506
Instruction ID: af85d4fac1f02b35d83054ac562db20e4e8b5e88aedad24ef3591fa2941f475b
Opcode Fuzzy Hash: 9c78346c2c6a33f1bf9d9da0a6fb53135ecc54b1d2bc50bcc8d38ac73d90d506
Instruction Fuzzy Hash: 9DE05034989218DFC7148F54E4596F8B77CE74A361F0060D9D50FA61A2D670D585CA91

Uniqueness

Uniqueness Score: -1.00%

Function 09BBE45B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041528262.0000000009BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0998ba4ab90d114b5b3bb3988cb55177f5082c22388c5adbe48125a835abac28
Instruction ID: 645eed9fa4336d1bc48bf7dc8b2e109561916994c53b61cd3d74d3289afd41b0
Opcode Fuzzy Hash: 0998ba4ab90d114b5b3bb3988cb55177f5082c22388c5adbe48125a835abac28
Instruction Fuzzy Hash: F3E092358C8218DFC710CB90B45A2F8BB7CF74B3A2F0171C9D90E9A162C23485418FA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.Heur.18737.25106.exePID: 4256, Parent PID: 6156COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	1

Executed Functions

Function 010C9B30 Relevance: 2.8, Instructions: 2812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3281643894.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8149790ab129fa1e47c423ce5e8eec0c13811129f9a81864cdd2c9e987519e1b
Instruction ID: 1b641b61b4270a71f40b0b2f026f1d79b87dc224ee9942286cb2095aedf2aa27
Opcode Fuzzy Hash: 8149790ab129fa1e47c423ce5e8eec0c13811129f9a81864cdd2c9e987519e1b
Instruction Fuzzy Hash: 9C53E431C10B1A8ADB51EB68C8845ADF7B1FF99300F15C79AE4587B121EB70AAD5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0606E190 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3285230730.0000000006060000.00000040.00000800.00020000.00000000.sdmp, Offset: 06060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6060000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29960e4848dda8dd4aaf8b3b5eca81faa1276c164bc4a0d7a365c458bc40c4b8
Instruction ID: d4ea12693c62dd7af6339b80d675be0188cded11b57a5555dca7ad581f768d52
Opcode Fuzzy Hash: 29960e4848dda8dd4aaf8b3b5eca81faa1276c164bc4a0d7a365c458bc40c4b8
Instruction Fuzzy Hash: 65410471D187958FCB04CFA9D8546DEBFF1EF89310F1485AAE404A7281DB789885CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0606E278 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0606E2DF

Memory Dump Source

Source File: 00000004.00000002.3285230730.0000000006060000.00000040.00000800.00020000.00000000.sdmp, Offset: 06060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6060000_SecuriteInfo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 17b86eb2730d26c0c29208dbcbd0a3ab4004021aad946151deaf3df0566de28c
Instruction ID: 06073f4789a4c26b14b7253debab22552c433870fe571fd964670149377ef3c3
Opcode Fuzzy Hash: 17b86eb2730d26c0c29208dbcbd0a3ab4004021aad946151deaf3df0566de28c
Instruction Fuzzy Hash: 1711E2B1C0065A9BCB10DF9AC544BEEFBF4AF48320F14816AE918B7240D778A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 010CF3FD Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH]q, xrefs: 010CF54B

Memory Dump Source

Source File: 00000004.00000002.3281643894.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 6eca485642456105b8b0cf0615642db74b31645e5ed19c33dc9c6ce519807b46
Instruction ID: 2e02756bdff094e74d14d4f0d0078c91ce4a5c49354c7ff25385350ccea7018a
Opcode Fuzzy Hash: 6eca485642456105b8b0cf0615642db74b31645e5ed19c33dc9c6ce519807b46
Instruction Fuzzy Hash: 8A3135307002028FDB59AB38E5606AE7FE7AF89640F2445BCD046DB395DE34CC46CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 010CCDA8 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3281643894.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35052d07b29c79d856788e36f1ceceebf7bf93464c2b6fdf721089e4a2660f2
Instruction ID: 5027660bf713cd2ea4ff18726f129a5e128e6c54e5375b886ed84d10709c908e
Opcode Fuzzy Hash: d35052d07b29c79d856788e36f1ceceebf7bf93464c2b6fdf721089e4a2660f2
Instruction Fuzzy Hash: 5DC10330B00216AFEB15DB68C880B6EBBA6FBC4710F148569D449DB396DB35EC42CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 010CF2C0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3281643894.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f4be9910f623a58373a1309094950acb538d19486a2bca5868ac0447e724c5
Instruction ID: 18270ac06dc42f865aae7998e32e883931610b490384b2a698ec1b7f37919257
Opcode Fuzzy Hash: b7f4be9910f623a58373a1309094950acb538d19486a2bca5868ac0447e724c5
Instruction Fuzzy Hash: 0E316B35E002069BDB19CF68D89469EBBF2FF89700F108529E846E7350EB70E842CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010CF2D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3281643894.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10c0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203626b31c27814cd14c6956646613b8fe3f5c4ddc6eb49d731c648550d4785d
Instruction ID: b453e61d36ed893f40634537ba60f5f7c87c3d6689b75fb26852181000320351
Opcode Fuzzy Hash: 203626b31c27814cd14c6956646613b8fe3f5c4ddc6eb49d731c648550d4785d
Instruction Fuzzy Hash: F6314B34E102069BDB59DF69D49469EBBF2BF89700F10C52DE846EB351DB70AC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00D2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3280965444.0000000000D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d2d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b06ba971d7e847d530a87e0912de90255c6f3731add58d6f207a1a37ee7d4e0
Instruction ID: 0238eed15a959c8356ef9e7138063e527d32b615c8bbecb3dab198f3d74233dd
Opcode Fuzzy Hash: 7b06ba971d7e847d530a87e0912de90255c6f3731add58d6f207a1a37ee7d4e0
Instruction Fuzzy Hash: 5921F571504244DFCB14DF24E684B16BF66FBA4318F24C569D9494B2A6C33AD807CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00D2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3280965444.0000000000D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d2d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6f09d75b91390530d0212c5452a5d5999bfc14fc255d97df31ad4ec083d340
Instruction ID: 64f5dc31b28cefc75f7162006caaa75b5d2f3cc27b826d98c11423ab1b7087a7
Opcode Fuzzy Hash: 3a6f09d75b91390530d0212c5452a5d5999bfc14fc255d97df31ad4ec083d340
Instruction Fuzzy Hash: F22150755093808FDB12CF24D994715BF72EB56314F28C5EAD8498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Heur.18737.25106.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Heur.18737.25106.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
SecuriteInfo.com.Heur.18737.25106.exe

Function 016E32E9 Relevance: 2.9, Strings: 2, Instructions: 372
COMMON

Function 016E3350 Relevance: 2.9, Strings: 2, Instructions: 357
COMMON

Function 016E3428 Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Function 016E1370 Relevance: 2.8, Strings: 2, Instructions: 255
COMMON

Function 016E1410 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Function 09BBCCFC Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Function 09BBCD08 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Function 016EC4D0 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Function 09BBC541 Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Function 09BBC548 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Function 09BBCAD0 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre