Edit tour
Windows
Analysis Report
SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exe |
| Analysis ID: | 1447597 |
| MD5: | 1295db15df2d7db394255d69e08d4b75 |
| SHA1: | e5b50acdc09fca94f7e9c0a7fc7e57ade9670607 |
| SHA256: | 1d679b6434ca87e87c226ff908f19221a09a885d1c0a33f8c868e5d45a440e7f |
| Tags: | exe |
| Infos: | |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found potential string decryption / allocating functions
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Classification
- System is w10x64
SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exe (PID: 6800 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Win64.Troj anX-gen.81 44.20316.e xe" MD5: 1295DB15DF2D7DB394255D69E08D4B75) 
conhost.exe (PID: 5552 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Binary or memory string: | memstr_0a66293d-0 | |
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Code function: | 0_2_00007FF7B34008C0 | |
| Source: | Code function: | 0_2_00007FF7B33F8840 | |
| Source: | Code function: | 0_2_00007FF7B34070A0 | |
| Source: | Code function: | 0_2_00007FF7B33D00B0 | |
| Source: | Code function: | 0_2_00007FF7B33F2390 | |
| Source: | Code function: | 0_2_00007FF7B33F77F0 | |
| Source: | Code function: | 0_2_00007FF7B33DD800 | |
| Source: | Code function: | 0_2_00007FF7B33DABB0 | |
| Source: | Code function: | 0_2_00007FF7B33DFBD0 | |
| Source: | Code function: | 0_2_00007FF7B33D1A90 | |
| Source: | Code function: | 0_2_00007FF7B33CA230 | |
| Source: | Code function: | 0_2_00007FF7B33D1650 | |
| Source: | Code function: | 0_2_00007FF7B33EBEF0 | |
| Source: | Code function: | 0_2_00007FF7B33D6160 | |
| Source: | Code function: | 0_2_00007FF7B33E0D80 | |
| Source: | Code function: | 0_2_00007FF7B33C5530 | |
| Source: | Code function: | 0_2_00007FF7B33C8940 | |
| Source: | Code function: | 0_2_00007FF7B33F6DA0 | |
| Source: | Code function: | 0_2_00007FF7B33ECDD0 | |
| Source: | Code function: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary string: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | String found in binary or memory: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00007FF7B34A9CDC | |
| Source: | Code function: | 0_2_00007FF7B34A9CDC | |
| Source: | Code function: | 0_2_00007FF7B33C5010 | |
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Code function: | 0_2_00007FF7B34A8F58 | |
| Source: | Code function: | 0_2_00007FF7B34A9AD8 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 DLL Side-Loading | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 System Time Discovery | Remote Services | 11 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 3 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 DLL Side-Loading | Security Account Manager | 2 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 47% | ReversingLabs | Win64.Trojan.Generic | ||
| 48% | Virustotal | Browse | ||
| 100% | Avira | HEUR/AGEN.1317117 | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
⊘No contacted domains info
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
⊘No contacted IP infos
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1447597 |
| Start date and time: | 2024-05-26 02:24:10 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 29s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 6 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exe |
| Detection: | MAL |
| Classification: | mal60.winEXE@2/0@0/0 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exe, PID 6800 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
⊘No simulations
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.64388099087652 |
| TrID: |
|
| File name: | SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exe |
| File size: | 1'368'576 bytes |
| MD5: | 1295db15df2d7db394255d69e08d4b75 |
| SHA1: | e5b50acdc09fca94f7e9c0a7fc7e57ade9670607 |
| SHA256: | 1d679b6434ca87e87c226ff908f19221a09a885d1c0a33f8c868e5d45a440e7f |
| SHA512: | 6f48eb81f7898f8a87ee87cf3a5e07d15b8edc2c2e05735ed5b8774785a8dc5e5d655af416a0999248cc5c555eaa84d05eafe5d7b0523c2c20ed6dd5fbe6dcb6 |
| SSDEEP: | 24576:faTpb4mknNnXCMZu+3caswaSd/OWYreOCghC2D8vjwiCk6sLvj8PUY0Y3jIqnmJ0:5CSBOWYreOXREwP3A4XIqnmJyDepSjBR |
| TLSH: | 46558D1A52AC00E9D1ABA27CD15B5A03F2F57C4903208FEB17F84DB41F676E15ABEB11 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gZ.G.4IG.4IG.4IN~.IS.4I.s5HA.4I!i.IO.4I.s1Hc.4I.s0HM.4I.s7HC.4I.v0H..4I.}0HE.4I.}1HE.4ISm5Ha.4I.T.ID.4IG.5IC.4I.s=HW.4I.s.IF.4 |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x1400f94c8 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows cui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x664C9B11 [Tue May 21 13:01:05 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 95621895602803ceecb416d0d9f95395 |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007F980491F06Ch |
| dec eax |
| add esp, 28h |
| jmp 00007F980491E8D7h |
| int3 |
| int3 |
| dec eax |
| sub esp, 28h |
| dec ebp |
| mov eax, dword ptr [ecx+38h] |
| dec eax |
| mov ecx, edx |
| dec ecx |
| mov edx, ecx |
| call 00007F980491EA72h |
| mov eax, 00000001h |
| dec eax |
| add esp, 28h |
| ret |
| int3 |
| int3 |
| int3 |
| inc eax |
| push ebx |
| inc ebp |
| mov ebx, dword ptr [eax] |
| dec eax |
| mov ebx, edx |
| inc ecx |
| and ebx, FFFFFFF8h |
| dec esp |
| mov ecx, ecx |
| inc ecx |
| test byte ptr [eax], 00000004h |
| dec esp |
| mov edx, ecx |
| je 00007F980491EA75h |
| inc ecx |
| mov eax, dword ptr [eax+08h] |
| dec ebp |
| arpl word ptr [eax+04h], dx |
| neg eax |
| dec esp |
| add edx, ecx |
| dec eax |
| arpl ax, cx |
| dec esp |
| and edx, ecx |
| dec ecx |
| arpl bx, ax |
| dec edx |
| mov edx, dword ptr [eax+edx] |
| dec eax |
| mov eax, dword ptr [ebx+10h] |
| mov ecx, dword ptr [eax+08h] |
| dec eax |
| mov eax, dword ptr [ebx+08h] |
| test byte ptr [ecx+eax+03h], 0000000Fh |
| je 00007F980491EA6Dh |
| movzx eax, byte ptr [ecx+eax+03h] |
| and eax, FFFFFFF0h |
| dec esp |
| add ecx, eax |
| dec esp |
| xor ecx, edx |
| dec ecx |
| mov ecx, ecx |
| pop ebx |
| jmp 00007F980491DD9Eh |
| int3 |
| dec eax |
| mov eax, esp |
| dec eax |
| mov dword ptr [eax+08h], ebx |
| dec eax |
| mov dword ptr [eax+10h], ebp |
| dec eax |
| mov dword ptr [eax+18h], esi |
| dec eax |
| mov dword ptr [eax+20h], edi |
| inc ecx |
| push esi |
| dec eax |
| sub esp, 20h |
| dec ecx |
| mov ebx, dword ptr [ecx+38h] |
| dec eax |
| mov esi, edx |
| dec ebp |
| mov esi, eax |
| dec eax |
| mov ebp, ecx |
| dec ecx |
| mov edx, ecx |
| dec eax |
| mov ecx, esi |
| dec ecx |
| mov edi, ecx |
| dec esp |
| lea eax, dword ptr [ebx+04h] |
| call 00007F980491E9D1h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x141b60 | 0x280 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x152000 | 0x1e8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x149000 | 0x8394 | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x153000 | 0x658 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x131c60 | 0x70 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x131e80 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x131cd0 | 0x138 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0xfe000 | 0xe60 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xfcfcc | 0xfd000 | 8b57defe85e36a8ad267cb8e7c5828e2 | False | 0.4725973860548419 | data | 6.468382320700018 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0xfe000 | 0x473f2 | 0x47400 | e71b093b1ce3a72244a2b124c4537958 | False | 0.5657209429824561 | data | 6.608613723886367 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x146000 | 0x2458 | 0xc00 | 58469bc1cbeaa379e4d19e7746bc964c | False | 0.18977864583333334 | data | 3.8698159446630442 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x149000 | 0x8394 | 0x8400 | 0d7524f023c6af9b39a7e20c12e23fde | False | 0.4881628787878788 | data | 6.090464654710249 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x152000 | 0x1e8 | 0x200 | 71927b404fb4db38df8106d023460c58 | False | 0.5390625 | data | 4.758721582235538 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x153000 | 0x658 | 0x800 | e585a8db87b976bd60202c90ed004a00 | False | 0.45849609375 | data | 4.739801765346825 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_MANIFEST | 0x152060 | 0x188 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5892857142857143 |
| DLL | Import |
|---|---|
| d3dx9_43.dll | D3DXCreateTextureFromFileA |
| KERNEL32.dll | Process32Next, DeleteFileA, SetConsoleCursorInfo, GetLastError, Sleep, OutputDebugStringW, InitializeSListHead, GetSystemTimeAsFileTime, CreateToolhelp32Snapshot, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetModuleHandleW, CreateEventW, ResetEvent, SetEvent, InitializeCriticalSectionAndSpinCount, GetFileSizeEx, HeapSize, InitializeCriticalSectionEx, GetStdHandle, SetConsoleScreenBufferSize, GetCurrentProcess, SetConsoleTitleA, SetPriorityClass, SetLastError, HeapFree, GetConsoleScreenBufferInfo, GetTempPathW, GetCurrentProcessId, CloseHandle, CreateThread, HeapAlloc, GetCurrentThread, GetConsoleWindow, GetCurrentThreadId, CreateFileW, VirtualAlloc, DeviceIoControl, VirtualFree, QueryPerformanceCounter, FreeLibrary, VerSetConditionMask, GetProcAddress, QueryPerformanceFrequency, LoadLibraryA, GetModuleHandleA, GlobalUnlock, WideCharToMultiByte, GlobalLock, GlobalFree, GlobalAlloc, MultiByteToWideChar, GetProcessHeap, DeleteCriticalSection, LocalFree, HeapDestroy, HeapReAlloc, FormatMessageA, EnterCriticalSection, LeaveCriticalSection, SleepEx, GetSystemDirectoryA, GetModuleFileNameA, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, WaitForSingleObjectEx, MoveFileExA, GetTickCount, VerifyVersionInfoA, CreateFileA |
| USER32.dll | SetCursorPos, EmptyClipboard, GetClipboardData, SetClipboardData, CloseClipboard, GetCursorPos, GetClientRect, GetForegroundWindow, SetCursor, OpenClipboard, FindWindowA, GetWindowThreadProcessId, GetWindow, DispatchMessageA, GetWindowRect, DestroyWindow, SetWindowPos, ShowWindow, GetAsyncKeyState, SetWindowLongA, GetWindowLongA, SetWindowDisplayAffinity, MoveWindow, SetMenu, EnumWindows, SetLayeredWindowAttributes, TranslateMessage, SendMessageA, PeekMessageA, GetDesktopWindow, SetWindowLongPtrA, ClientToScreen, UpdateWindow, GetKeyState, LoadCursorA, ScreenToClient, MessageBoxA |
| ADVAPI32.dll | CryptEncrypt, CryptDestroyKey, CryptDestroyHash, CryptHashData, CryptCreateHash, QueryServiceStatus, ConvertSidToStringSidA, OpenSCManagerA, CopySid, IsValidSid, OpenProcessToken, GetLengthSid, OpenServiceA, GetTokenInformation, RegSetKeyValueW, RegCloseKey, RegDeleteTreeW, RegCreateKeyW, RegOpenKeyW, CryptGenRandom, CryptImportKey, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextA |
| SHELL32.dll | SHGetFolderPathA, ShellExecuteA |
| IMM32.dll | ImmSetCompositionWindow, ImmSetCandidateWindow, ImmAssociateContextEx, ImmReleaseContext, ImmGetContext |
| dwmapi.dll | DwmExtendFrameIntoClientArea |
| MSVCP140.dll | ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ??Bid@locale@std@@QEAA_KXZ, ?uncaught_exceptions@std@@YAHXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, _Query_perf_frequency, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?_Xbad_alloc@std@@YAXXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Throw_C_error@std@@YAXH@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z, ?id@?$ctype@D@std@@2V0locale@2@A, _Mtx_destroy_in_situ, _Mtx_lock, _Mtx_init_in_situ, _Thrd_sleep, _Query_perf_counter, _Xtime_get_ticks, _Mtx_unlock, ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z, ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ, ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?_Xout_of_range@std@@YAXPEBD@Z, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z |
| ntdll.dll | RtlInitUnicodeString, RtlVirtualUnwind, RtlCaptureContext, RtlLookupFunctionEntry, NtRaiseHardError, RtlAdjustPrivilege, NtQuerySystemInformation |
| SHLWAPI.dll | PathFileExistsA, PathAppendA |
| USERENV.dll | UnloadUserProfile |
| d3d9.dll | Direct3DCreate9Ex |
| urlmon.dll | URLDownloadToFileA |
| Normaliz.dll | IdnToAscii |
| WLDAP32.dll | |
| CRYPT32.dll | CertGetNameStringA, CryptQueryObject, CertCreateCertificateChainEngine, CertFreeCertificateChainEngine, CertGetCertificateChain, CertFreeCertificateChain, CertOpenStore, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertFindCertificateInStore, CertFindExtension, CertEnumCertificatesInStore, CertCloseStore, CertFreeCertificateContext |
| WS2_32.dll | ntohl, gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, closesocket, socket, setsockopt, recv, ntohs, htons, send, getsockopt, getsockname, getpeername, WSAGetLastError, connect, bind |
| RPCRT4.dll | UuidToStringA, UuidCreate, RpcStringFreeA |
| PSAPI.DLL | GetModuleInformation |
| VCRUNTIME140_1.dll | __CxxFrameHandler4 |
| VCRUNTIME140.dll | strrchr, memset, memmove, memcpy, memcmp, __current_exception_context, __current_exception, memchr, _CxxThrowException, __C_specific_handler, wcsstr, __std_exception_copy, __std_exception_destroy, strstr, __std_terminate, strchr |
| api-ms-win-crt-stdio-l1-1-0.dll | _read, _write, _close, _open, __stdio_common_vsprintf, fread, __stdio_common_vsscanf, fputs, fopen, feof, _wfopen, fputc, fwrite, __p__commode, fseek, _popen, _pclose, fgets, _set_fmode, fclose, __stdio_common_vsnprintf_s, fflush, __acrt_iob_func, ftell, __stdio_common_vfprintf, _lseeki64, _get_stream_buffer_pointers, _fseeki64, fsetpos, ungetc, fgetc, fgetpos, setvbuf |
| api-ms-win-crt-string-l1-1-0.dll | strcspn, strspn, isupper, strcmp, strncmp, strpbrk, strncpy, _stricmp, tolower, _strdup |
| api-ms-win-crt-utility-l1-1-0.dll | qsort, srand, rand |
| api-ms-win-crt-heap-l1-1-0.dll | free, malloc, _set_new_mode, realloc, calloc, _callnewh |
| api-ms-win-crt-convert-l1-1-0.dll | strtod, strtoul, atoi, strtol, strtoull, strtoll |
| api-ms-win-crt-runtime-l1-1-0.dll | _getpid, _beginthread, _invalid_parameter_noinfo, system, terminate, _errno, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _beginthreadex, _get_initial_narrow_environment, _initterm, _initterm_e, _exit, abort, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, strerror, exit, _resetstkoflw, __sys_nerr, _invalid_parameter_noinfo_noreturn |
| api-ms-win-crt-filesystem-l1-1-0.dll | _access, _stat64, _lock_file, _unlock_file, _fstat64, _wremove, _unlink |
| api-ms-win-crt-time-l1-1-0.dll | _time64, _gmtime64 |
| api-ms-win-crt-locale-l1-1-0.dll | localeconv, _configthreadlocale |
| api-ms-win-crt-math-l1-1-0.dll | sin, _dclass, sinf, asinf, acosf, _fdclass, sqrtf, fmodf, cosf, cos, __setusermatherr, atan2f, ceilf |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 20:25:00 |
| Start date: | 25/05/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7b33b0000 |
| File size: | 1'368'576 bytes |
| MD5 hash: | 1295DB15DF2D7DB394255D69E08D4B75 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 20:25:00 |
| Start date: | 25/05/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6d64d0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
Analysis Process: SecuriteInfo.com.Win64.TrojanX-gen.8144.20316.exePID: 6800, Parent PID: 1028COMMON
Function 00007FF7B33C8940 Relevance: 88.8, APIs: 13, Strings: 37, Instructions: 1293COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33CA230 Relevance: 57.2, APIs: 10, Strings: 22, Instructions: 1213COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33D1A90 Relevance: 36.0, APIs: 15, Strings: 5, Instructions: 993fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33C5530 Relevance: 30.2, APIs: 10, Strings: 10, Instructions: 196COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B34A9CDC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33EBEF0 Relevance: .9, Instructions: 868COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33E0D80 Relevance: .4, Instructions: 430COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33F77F0 Relevance: .4, Instructions: 413COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33F8840 Relevance: .3, Instructions: 342COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33DD800 Relevance: .3, Instructions: 300COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33D1650 Relevance: .3, Instructions: 287COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33F2390 Relevance: .1, Instructions: 118COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33D00B0 Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33C823A Relevance: 30.0, APIs: 1, Strings: 16, Instructions: 250COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B3403810 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 299COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33CC5B0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 429COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33EECF0 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 265COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33D2C10 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 221COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33CFA00 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 232COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33CD480 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 116COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33D4300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B34074E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B33FF730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7B34077D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|