Windows Analysis Report
jpgcamscanner_20240521_0072345_JPEG.bat.exe

Overview

General Information

Sample name: jpgcamscanner_20240521_0072345_JPEG.bat.exe
Analysis ID: 1445937
MD5: 18776562551c3adcdc9f49c013772fbd
SHA1: ee124b7cd0296b4e524454ab12059b8be60bc002
SHA256: 05df6f3430171cb7db9fa5f6782b8f67b14079b6e1dffbb013c33ca91b1ad5d3
Infos:

Detection

GuLoader
Score: 92
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Check if machine is in data center or colocation facility
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://veysiseker.com/FOB.bin Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe ReversingLabs: Detection: 34%
Machine Learning detection for sample
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_0040626D FindFirstFileA,FindClose, 2_2_0040626D
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 2_2_00405732
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004026FE FindFirstFileA, 2_2_004026FE
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_0040626D FindFirstFileA,FindClose, 4_2_0040626D
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 4_2_00405732
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_004026FE FindFirstFileA, 4_2_004026FE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TUT-ASUS TUT-ASUS
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /FOB.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: veysiseker.comCache-Control: no-cache
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /FOB.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: veysiseker.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: veysiseker.com
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24172966883.0000000033841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24172966883.0000000033841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24172966883.0000000033841000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24163498581.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24162722819.0000000002F78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://veysiseker.com/FOB.bin
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004051CF GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 2_2_004051CF
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_004031D6
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_004031D6
Detected potential crypto function
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_00404A0E 2_2_00404A0E
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004065F6 2_2_004065F6
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_6DDA1A9C 2_2_6DDA1A9C
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_00404A0E 4_2_00404A0E
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_004065F6 4_2_004065F6
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_00158908 4_2_00158908
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_00154908 4_2_00154908
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_001581C5 4_2_001581C5
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_00153CF0 4_2_00153CF0
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_0015BD00 4_2_0015BD00
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_00154038 4_2_00154038
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_0015E73F 4_2_0015E73F
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A3D20 4_2_359A3D20
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A1BE0 4_2_359A1BE0
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A9366 4_2_359A9366
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A5E80 4_2_359A5E80
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359AA6B8 4_2_359AA6B8
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A46E8 4_2_359A46E8
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A0128 4_2_359A0128
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A64CF 4_2_359A64CF
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359A5798 4_2_359A5798
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_001589C2 4_2_001589C2
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: String function: 00402ACB appears 48 times
Sample file is different than original file name gathered from version info
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000002.00000000.19073539033.0000000000458000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamerainiers.exe4 vs jpgcamscanner_20240521_0072345_JPEG.bat.exe
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24158159870.0000000000458000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamerainiers.exe4 vs jpgcamscanner_20240521_0072345_JPEG.bat.exe
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24162722819.0000000002FD6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs jpgcamscanner_20240521_0072345_JPEG.bat.exe
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe Binary or memory string: OriginalFilenamerainiers.exe4 vs jpgcamscanner_20240521_0072345_JPEG.bat.exe
Uses 32bit PE files
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal92.troj.spyw.evad.winEXE@4/18@2/2
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_004031D6
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_004031D6
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_0040449B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 2_2_0040449B
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004020D1 CoCreateInstance,MultiByteToWideChar, 2_2_004020D1
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Mutant created: NULL
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File created: C:\Users\user\AppData\Local\Temp\nsq45DA.tmp Jump to behavior
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\dllhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File read: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe "C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe"
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process created: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe "C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe"
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: photometadatahandler.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: mfsrcsnk.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Windows\System32\dllhost.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000002.00000002.19322780922.0000000005951000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_6DDA1A9C GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 2_2_6DDA1A9C
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_6DDA2F20 push eax; ret 2_2_6DDA2F4E
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359AB9E3 push FAF8B93Ch; ret 4_2_359AB9E9
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359ABBF6 push FAF8B93Ch; ret 4_2_359ABBFF
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359ABB44 push FAF8B93Ch; ret 4_2_359ABB4D
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359ABA95 push FAF8B93Ch; ret 4_2_359ABA9B
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_359ABAEB push FAF8B93Ch; ret 4_2_359ABAF4
Drops PE files
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File created: C:\Users\user\AppData\Local\Temp\nsm54DF.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File created: C:\Users\user\AppData\Local\Temp\nsm54DF.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File created: C:\Users\user\AppData\Local\Temp\nsm54DF.tmp\BgImage.dll Jump to dropped file
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\System32\dllhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Memory allocated: 110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Memory allocated: 33840000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Memory allocated: 33300000 memory reserve | memory write watch Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm54DF.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm54DF.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm54DF.tmp\BgImage.dll Jump to dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\System32\dllhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\System32\dllhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_0040626D FindFirstFileA,FindClose, 2_2_0040626D
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 2_2_00405732
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004026FE FindFirstFileA, 2_2_004026FE
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_0040626D FindFirstFileA,FindClose, 4_2_0040626D
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 4_2_00405732
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 4_2_004026FE FindFirstFileA, 4_2_004026FE
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24162722819.0000000002FD6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWM
Source: jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24162722819.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, jpgcamscanner_20240521_0072345_JPEG.bat.exe, 00000004.00000002.24162722819.0000000002FD6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe API call chain: ExitProcess graph end node
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_6DDA1A9C GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 2_2_6DDA1A9C
Enables debug privileges
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Queries volume information: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Code function: 2_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_004031D6
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\jpgcamscanner_20240521_0072345_JPEG.bat.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000004.00000002.24172966883.0000000033875000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: jpgcamscanner_20240521_0072345_JPEG.bat.exe PID: 7232, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1445937 Sample: jpgcamscanner_20240521_0072... Startdate: 22/05/2024 Architecture: WINDOWS Score: 92 23 ip-api.com 2->23 25 veysiseker.com 2->25 31 Antivirus detection for URL or domain 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 Yara detected GuLoader 2->35 37 2 other signatures 2->37 7 jpgcamscanner_20240521_0072345_JPEG.bat.exe 2 43 2->7         started        signatures3 process4 file5 17 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 7->17 dropped 19 C:\Users\user\AppData\Local\...\System.dll, PE32 7->19 dropped 21 C:\Users\user\AppData\Local\...\BgImage.dll, PE32 7->21 dropped 39 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->39 11 jpgcamscanner_20240521_0072345_JPEG.bat.exe 15 8 7->11         started        15 dllhost.exe 1 7->15         started        signatures6 process7 dnsIp8 27 ip-api.com 208.95.112.1, 59327, 80 TUT-ASUS United States 11->27 29 veysiseker.com 192.250.227.27, 59326, 80 CNSV-LLCUS United States 11->29 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->41 43 Tries to steal Mail credentials (via file / registry access) 11->43 45 Tries to harvest and steal ftp login credentials 11->45 47 Tries to harvest and steal browser information (history, passwords, etc) 11->47 49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->49 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.250.227.27
 veysiseker.com United States
36454 CNSV-LLCUS false
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS true

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true
veysiseker.com 192.250.227.27 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://veysiseker.com/FOB.bin false
  • Avira URL Cloud: malware
 unknown
http://ip-api.com/line/?fields=hosting false
  • Avira URL Cloud: safe
 unknown