Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1453785
MD5:	7dc8189f70cc34e18ea7af8fdeac4142
SHA1:	8cb698efdf5971e0805dd0f0fb0457315490c777
SHA256:	a3608a51db9df14c42f8c6e37ac49969de70b4be0862d82b5823c00aed395f9d
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://116.202.190.18:5432/softokn3.dllP	Avira URL Cloud: Label: malware
Source: https://116.202.190.18/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/msvcp140.dlldge	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dllIQ=E	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dllZ	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/freebl3.dllEdge	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/sqls.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/freebl3.dlla	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/reebl3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/mozglue.dllEdge	Avira URL Cloud: Label: malware
Source: https://t.me/r8z0l	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/freebl3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dll9	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/nss3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/mozglue.dlls	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dllser	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dll/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/sqls.dllx	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/.190.18:5432/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/oft	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/My	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/nss3.dllO	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/mozglue.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dllOMh	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/nss3.dllft	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dllUser	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/ng	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dlldge	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199698764354	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199698764354", "https://t.me/r8z0l"], "Botnet": "8bd2ac5f1dd228859ac690a79c0bde71"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406DE2 CryptUnprotectData,LocalAlloc,LocalFree,	2_2_00406DE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040245C memset,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	2_2_0040245C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00411B94 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00411B94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406D7F CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00406D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00408E1E memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,	2_2_00408E1E

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D5B1 FindFirstFileExW,	0_2_0100D5B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D2FF _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040D2FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C0F8 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A17A _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A17A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00417295 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00417295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A595 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A595
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B616 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040B616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004176DE _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004176DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416824 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_00416824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040AC07 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040AC07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416EF1 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_00416EF1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00416C71 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

2_2_00416C71

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199698764354
Source: Malware configuration extractor	URLs: https://t.me/r8z0l

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 116.202.190.18:5432

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /r8z0l HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004041B2 _EH_prolog,GetProcessHeap,RtlAllocateHeap,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_004041B2

Source: global traffic

HTTP traffic detected: GET /r8z0l HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: file.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: file.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, 00000002.00000002.3331463797.000000001B8CD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18/
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/.190.18:5432/
Source: RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/My
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/freebl3.dllEdge
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/freebl3.dlla
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/mozglue.dllEdge
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/mozglue.dlls
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/msvcp140.dlldge
Source: RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/ng
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/nss3.dll
Source: RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/nss3.dllO
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/nss3.dllft
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/oft
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/reebl3.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dllOMh
Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dllP
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dllZ
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dlldge
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000491000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/sqls.dll
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/sqls.dllx
Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001268000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dll/
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dll9
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dllIQ=E
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dllUser
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dllser
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432A
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000497000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432AMicrosoft
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432Content-Disposition:
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004B6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432c84cgle
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432fold
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432ing
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000453000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432l
Source: FBKECF.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FBKECF.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FBKECF.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: FBKECF.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FBKECF.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FBKECF.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FBKECF.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.2070870185.0000000001023000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199698764354
Source: RegAsm.exe, 00000002.00000002.3326265923.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/i
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r8z0l
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r8z0lF
Source: RegAsm.exe, 00000002.00000002.3326265923.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000453000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: FBKECF.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: FBKECF.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2

Contains functionality to record screenshots

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004120E5 _EH_prolog,memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_004120E5

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen

Detected potential crypto function

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010080C2	0_2_010080C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003530	0_2_01003530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01011583	0_2_01011583
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01000454	0_2_01000454
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100C81A	0_2_0100C81A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100FBE5	0_2_0100FBE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D079	2_2_0041D079
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E1F7	2_2_0041E1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D5CA	2_2_0041D5CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041F6E0	2_2_0041F6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B694CF0	2_2_1B694CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A9A20	2_2_1B7A9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B682018	2_2_1B682018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B735940	2_2_1B735940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B681C9E	2_2_1B681C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B682AA9	2_2_1B682AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6812A8	2_2_1B6812A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B1C50	2_2_1B6B1C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7E9CC0	2_2_1B7E9CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68292D	2_2_1B68292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B683580	2_2_1B683580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7153B0	2_2_1B7153B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B85D209	2_2_1B85D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A5040	2_2_1B7A5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B699000	2_2_1B699000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B73D6D0	2_2_1B73D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B729690	2_2_1B729690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7E9430	2_2_1B7E9430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68D4C0	2_2_1B68D4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B784A60	2_2_1B784A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68C800	2_2_1B68C800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B681EF1	2_2_1B681EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6BCE10	2_2_1B6BCE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8D2A	2_2_1B6A8D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B683AB2	2_2_1B683AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B708120	2_2_1B708120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A8030	2_2_1B7A8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B700090	2_2_1B700090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8763	2_2_1B6A8763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6E4760	2_2_1B6E4760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B718760	2_2_1B718760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8680	2_2_1B6A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7C0480	2_2_1B7C0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6ABAB0	2_2_1B6ABAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68251D	2_2_1B68251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B7810	2_2_1B6B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68290A	2_2_1B68290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B3370	2_2_1B6B3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68F160	2_2_1B68F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68174E	2_2_1B68174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68AA40	2_2_1B68AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68EA80	2_2_1B68EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B77A940	2_2_1B77A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B79A900	2_2_1B79A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7669C0	2_2_1B7669C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68481D	2_2_1B68481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7BE800	2_2_1B7BE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B683E3B	2_2_1B683E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B85AEBE	2_2_1B85AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6E2EE0	2_2_1B6E2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6C6E80	2_2_1B6C6E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6819DD	2_2_1B6819DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68209F	2_2_1B68209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B70A0B0	2_2_1B70A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6966C0	2_2_1B6966C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6AA560	2_2_1B6AA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B77A590	2_2_1B77A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6847AF	2_2_1B6847AF

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00FFA750 appears 52 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B683AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B68395E appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B681F5A appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B8606B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004195FA appears 112 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004024D7 appears 312 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B68415B appears 173 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B681C2B appears 47 times

PE / OLE file has an invalid certificate

Source: file.exe

Static PE information: invalid certificate

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004110AB _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_004110AB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004114AC _EH_prolog,CoCreateInstance,SysAllocString,_wtoi64,SysFreeString,SysFreeString,

2_2_004114AC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\60JGYAOC.htm

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: IDAEHC.2.dr, HJJKFB.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418AFD GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00418AFD

PE file contains sections with non-standard names

Source: sqls[1].dll.2.dr

Static PE information: section name: .00cfg

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA00C push ecx; ret	0_2_00FFA01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A725 push ecx; ret	2_2_0041A738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B681BF9 push ecx; ret	2_2_1B824C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6810C8 push ecx; ret	2_2_1B883552

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqls[1].dll

Jump to dropped file

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00418AFD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqls[1].dll

Jump to dropped file

Found evasive API chain (date check)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410ACD GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410BE0h

2_2_00410ACD

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D5B1 FindFirstFileExW,	0_2_0100D5B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D2FF _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040D2FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C0F8 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A17A _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A17A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00417295 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00417295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A595 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A595
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B616 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040B616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004176DE _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004176DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416824 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_00416824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040AC07 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040AC07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416EF1 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_00416EF1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00416C71 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

2_2_00416C71

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410C69 GetSystemInfo,wsprintfA,

2_2_00410C69

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: JEHIID.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: JEHIID.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JEHIID.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011B4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326265923.000000000113A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JEHIID.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JEHIID.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: JEHIID.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JEHIID.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JEHIID.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JEHIID.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JEHIID.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JEHIID.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JEHIID.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JEHIID.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JEHIID.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.3326127639.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JEHIID.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: JEHIID.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: JEHIID.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FFE423 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00FFE423

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00418AFD

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100C44B mov eax, dword ptr fs:[00000030h]		0_2_0100C44B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010049AA mov ecx, dword ptr fs:[00000030h]		0_2_010049AA

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01010CFB GetProcessHeap,

0_2_01010CFB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFE423 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FFE423
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA52A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FFA52A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA686 SetUnhandledExceptionFilter,	0_2_00FFA686
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA7C3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00FFA7C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A8CF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041A8CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041F988 SetUnhandledExceptionFilter,	2_2_0041F988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041BDF7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041BDF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6842AF SetUnhandledExceptionFilter,	2_2_1B6842AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B682C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_1B682C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC018D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_00FC018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411FA6 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_00411FA6

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 642000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DDC008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FFA215 cpuid

0_2_00FFA215

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_01010135
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_010103D7
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_01007515
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_01010548
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_01010422
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_010104BD
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0101079B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_010109CA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_010108C4
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_01007A3B
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_01010A99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _EH_prolog,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00410ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1B682112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1B682112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1B85FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_1B68298C

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FFA424 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FFA424

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004109B3 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_004109B3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410A7A GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00410A7A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001268000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2070870185.0000000001023000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2070870185.0000000001023000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FDB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1B6FDB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B725910 sqlite3_mprintf,sqlite3_bind_int64,	2_2_1B725910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7AD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1B7AD9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B701FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B701FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FDFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	2_2_1B6FDFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B695C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1B695C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B73D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B73D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7251D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B7251D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B719090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	2_2_1B719090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B75D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B75D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7255B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B7255B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7AD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1B7AD4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1B7A14D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B8970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	2_2_1B6B8970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B694820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	2_2_1B694820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1B6B0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B764D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1B764D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B8CB0 sqlite3_bind_zeroblob,	2_2_1B6B8CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6F8200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_1B6F8200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B764140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_1B764140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6D06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_1B6D06E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	2_2_1B6A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6D8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	2_2_1B6D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B8430 sqlite3_bind_int64,	2_2_1B6B8430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B7810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1B6B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B743770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B743770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7637E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B7637E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6AB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	2_2_1B6AB400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6DEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	2_2_1B6DEF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6EE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_1B6EE200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FE170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B6FE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6EE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1B6EE090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FA6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	2_2_1B6FA6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6966C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1B6966C0

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.202.190.18	unknown	Germany		24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	true

Contacted Domains

Name	IP	Active
t.me	149.154.167.99	true
198.187.3.20.in-addr.arpa	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/r8z0l	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199698764354	true	Avira URL Cloud: malware	unknown

AV Detection

Antivirus detection for URL or domain

Source: https://116.202.190.18:5432/softokn3.dllP	Avira URL Cloud: Label: malware
Source: https://116.202.190.18/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/msvcp140.dlldge	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dllIQ=E	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dllZ	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/freebl3.dllEdge	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/sqls.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/freebl3.dlla	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/reebl3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/mozglue.dllEdge	Avira URL Cloud: Label: malware
Source: https://t.me/r8z0l	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/freebl3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dll9	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/nss3.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/mozglue.dlls	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dllser	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dll/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/sqls.dllx	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/.190.18:5432/	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/oft	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/My	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/nss3.dllO	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/mozglue.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dllOMh	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/nss3.dllft	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/vcruntime140.dllUser	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/ng	Avira URL Cloud: Label: malware
Source: https://116.202.190.18:5432/softokn3.dlldge	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199698764354	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199698764354", "https://t.me/r8z0l"], "Botnet": "8bd2ac5f1dd228859ac690a79c0bde71"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406DE2 CryptUnprotectData,LocalAlloc,LocalFree,	2_2_00406DE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040245C memset,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	2_2_0040245C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00411B94 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00411B94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406D7F CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00406D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00408E1E memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,	2_2_00408E1E

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D5B1 FindFirstFileExW,	0_2_0100D5B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D2FF _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040D2FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C0F8 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A17A _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A17A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00417295 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00417295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A595 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A595
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B616 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040B616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004176DE _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004176DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416824 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_00416824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040AC07 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040AC07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416EF1 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_00416EF1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00416C71 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

2_2_00416C71

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199698764354
Source: Malware configuration extractor	URLs: https://t.me/r8z0l

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 116.202.190.18:5432

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /r8z0l HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.190.18

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004041B2

Source: global traffic

HTTP traffic detected: GET /r8z0l HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: file.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: file.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, 00000002.00000002.3331463797.000000001B8CD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18/
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/.190.18:5432/
Source: RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/My
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/freebl3.dllEdge
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/freebl3.dlla
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/mozglue.dllEdge
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/mozglue.dlls
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/msvcp140.dlldge
Source: RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/ng
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/nss3.dll
Source: RegAsm.exe, 00000002.00000002.3326684704.0000000001397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/nss3.dllO
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/nss3.dllft
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/oft
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/reebl3.dll
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dllOMh
Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dllP
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dllZ
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/softokn3.dlldge
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000491000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/sqls.dll
Source: RegAsm.exe, 00000002.00000002.3326524144.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/sqls.dllx
Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001268000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dll/
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dll9
Source: RegAsm.exe, 00000002.00000002.3326444422.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dllIQ=E
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dllUser
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432/vcruntime140.dllser
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432A
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000497000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432AMicrosoft
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432Content-Disposition:
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004B6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432c84cgle
Source: RegAsm.exe, 00000002.00000002.3325415366.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432fold
Source: RegAsm.exe, 00000002.00000002.3325415366.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432ing
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000453000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://116.202.190.18:5432l
Source: FBKECF.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FBKECF.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FBKECF.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: FBKECF.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FBKECF.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FBKECF.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FBKECF.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.2070870185.0000000001023000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199698764354
Source: RegAsm.exe, 00000002.00000002.3326265923.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/i
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r8z0l
Source: RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r8z0lF
Source: RegAsm.exe, 00000002.00000002.3326265923.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000453000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326265923.0000000001193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: FBKECF.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: FBKECF.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2

Contains functionality to record screenshots

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004120E5

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen

Detected potential crypto function

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010080C2	0_2_010080C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003530	0_2_01003530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01011583	0_2_01011583
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01000454	0_2_01000454
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100C81A	0_2_0100C81A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100FBE5	0_2_0100FBE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D079	2_2_0041D079
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E1F7	2_2_0041E1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D5CA	2_2_0041D5CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041F6E0	2_2_0041F6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B694CF0	2_2_1B694CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A9A20	2_2_1B7A9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B682018	2_2_1B682018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B735940	2_2_1B735940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B681C9E	2_2_1B681C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B682AA9	2_2_1B682AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6812A8	2_2_1B6812A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B1C50	2_2_1B6B1C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7E9CC0	2_2_1B7E9CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68292D	2_2_1B68292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B683580	2_2_1B683580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7153B0	2_2_1B7153B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B85D209	2_2_1B85D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A5040	2_2_1B7A5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B699000	2_2_1B699000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B73D6D0	2_2_1B73D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B729690	2_2_1B729690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7E9430	2_2_1B7E9430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68D4C0	2_2_1B68D4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B784A60	2_2_1B784A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68C800	2_2_1B68C800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B681EF1	2_2_1B681EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6BCE10	2_2_1B6BCE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8D2A	2_2_1B6A8D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B683AB2	2_2_1B683AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B708120	2_2_1B708120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A8030	2_2_1B7A8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B700090	2_2_1B700090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8763	2_2_1B6A8763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6E4760	2_2_1B6E4760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B718760	2_2_1B718760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8680	2_2_1B6A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7C0480	2_2_1B7C0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6ABAB0	2_2_1B6ABAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68251D	2_2_1B68251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B7810	2_2_1B6B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68290A	2_2_1B68290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B3370	2_2_1B6B3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68F160	2_2_1B68F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68174E	2_2_1B68174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68AA40	2_2_1B68AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68EA80	2_2_1B68EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B77A940	2_2_1B77A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B79A900	2_2_1B79A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7669C0	2_2_1B7669C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68481D	2_2_1B68481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7BE800	2_2_1B7BE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B683E3B	2_2_1B683E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B85AEBE	2_2_1B85AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6E2EE0	2_2_1B6E2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6C6E80	2_2_1B6C6E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6819DD	2_2_1B6819DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B68209F	2_2_1B68209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B70A0B0	2_2_1B70A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6966C0	2_2_1B6966C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6AA560	2_2_1B6AA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B77A590	2_2_1B77A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6847AF	2_2_1B6847AF

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00FFA750 appears 52 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B683AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B68395E appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B681F5A appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B8606B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004195FA appears 112 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004024D7 appears 312 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B68415B appears 173 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B681C2B appears 47 times

PE / OLE file has an invalid certificate

Source: file.exe

Static PE information: invalid certificate

Uses 32bit PE files

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004110AB _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_004110AB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004114AC _EH_prolog,CoCreateInstance,SysAllocString,_wtoi64,SysFreeString,SysFreeString,

2_2_004114AC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\60JGYAOC.htm

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: IDAEHC.2.dr, HJJKFB.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000002.00000002.3327352173.0000000015922000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3331334896.000000001B898000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00418AFD

PE file contains sections with non-standard names

Source: sqls[1].dll.2.dr

Static PE information: section name: .00cfg

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA00C push ecx; ret	0_2_00FFA01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A725 push ecx; ret	2_2_0041A738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B681BF9 push ecx; ret	2_2_1B824C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6810C8 push ecx; ret	2_2_1B883552

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqls[1].dll

Jump to dropped file

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00418AFD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqls[1].dll

Jump to dropped file

Found evasive API chain (date check)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410ACD GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410BE0h

2_2_00410ACD

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D5B1 FindFirstFileExW,	0_2_0100D5B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D2FF _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040D2FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C0F8 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A17A _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A17A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00417295 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00417295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A595 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040A595
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B616 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040B616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004176DE _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004176DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416824 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_00416824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040AC07 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040AC07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416EF1 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_00416EF1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00416C71 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

2_2_00416C71

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410C69 GetSystemInfo,wsprintfA,

2_2_00410C69

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: JEHIID.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: JEHIID.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JEHIID.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011B4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3326265923.000000000113A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JEHIID.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JEHIID.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: JEHIID.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JEHIID.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JEHIID.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JEHIID.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JEHIID.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JEHIID.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JEHIID.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JEHIID.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JEHIID.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JEHIID.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000002.00000002.3326127639.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JEHIID.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JEHIID.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000002.00000002.3326265923.00000000011B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: JEHIID.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: JEHIID.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FFE423 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00FFE423

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00418AFD

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100C44B mov eax, dword ptr fs:[00000030h]		0_2_0100C44B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010049AA mov ecx, dword ptr fs:[00000030h]		0_2_010049AA

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01010CFB GetProcessHeap,

0_2_01010CFB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFE423 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FFE423
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA52A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FFA52A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA686 SetUnhandledExceptionFilter,	0_2_00FFA686
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFA7C3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00FFA7C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A8CF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041A8CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041F988 SetUnhandledExceptionFilter,	2_2_0041F988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041BDF7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041BDF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6842AF SetUnhandledExceptionFilter,	2_2_1B6842AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B682C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_1B682C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

0_2_00FC018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411FA6 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_00411FA6

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 642000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DDC008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FFA215 cpuid

0_2_00FFA215

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_01010135
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_010103D7
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_01007515
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_01010548
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_01010422
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_010104BD
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0101079B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_010109CA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_010108C4
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_01007A3B
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_01010A99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _EH_prolog,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00410ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1B682112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1B682112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1B85FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_1B68298C

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FFA424 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FFA424

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004109B3 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_004109B3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00410A7A GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00410A7A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: RegAsm.exe, 00000002.00000002.3326524144.0000000001268000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2070870185.0000000001023000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2070870185.0000000001023000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3325415366.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2780, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FDB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1B6FDB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B725910 sqlite3_mprintf,sqlite3_bind_int64,	2_2_1B725910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7AD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1B7AD9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B701FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B701FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FDFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	2_2_1B6FDFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B695C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1B695C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B73D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B73D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7251D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B7251D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B719090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	2_2_1B719090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B75D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B75D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7255B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B7255B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7AD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1B7AD4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7A14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1B7A14D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B8970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	2_2_1B6B8970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B694820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	2_2_1B694820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1B6B0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B764D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1B764D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B8CB0 sqlite3_bind_zeroblob,	2_2_1B6B8CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6F8200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_1B6F8200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B764140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_1B764140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6D06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_1B6D06E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6A8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	2_2_1B6A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6D8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	2_2_1B6D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B8430 sqlite3_bind_int64,	2_2_1B6B8430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6B7810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1B6B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B743770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B743770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B7637E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B7637E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6AB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	2_2_1B6AB400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6DEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	2_2_1B6DEF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6EE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_1B6EE200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FE170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1B6FE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6EE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1B6EE090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6FA6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	2_2_1B6FA6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1B6966C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1B6966C0

ID:	1453785
Product:	CloudBasic
Start time:	17:20:09
Start date:	07.06.2024
Sample:	file.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	7dc8189f70cc34e18ea7af8fdeac4142
SHA1:	8cb698efdf5971e0805dd0f0fb0457315490c777
SHA256:	a3608a51db9df14c42f8c6e37ac49969de70b4be0862d82b5823c00aed395f9d
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\ECGHJJEHDHCA\BFCGDA	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1	7B955D976803304F2C0505431A0CF1CF	E29070081B18DA0EF9D98D4389091962E3D37216	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
C:\ProgramData\ECGHJJEHDHCA\BGDGHJ	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1	52701A76A821CDDBC23FB25C3FCA4968	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
C:\ProgramData\ECGHJJEHDHCA\DBKKFC	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4	9D46F142BBCF25D0D495FF1F3A7609D3	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
C:\ProgramData\ECGHJJEHDHCA\EBGDHJ	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7	CFFF4E2B77FC5A18AB6323AF9BF95339	3AA2C2115A8EB4516049600E8832E9BFFE0C2412	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
C:\ProgramData\ECGHJJEHDHCA\FBKECF	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3	429F49156428FD53EB06FC82088FD324	560E48154B4611838CD4E9DF4C14D0F9840F06AF	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
C:\ProgramData\ECGHJJEHDHCA\HJJKFB	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1	28222628A3465C5F0D4B28F70F97F482	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
C:\ProgramData\ECGHJJEHDHCA\IDAEHC	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\ProgramData\ECGHJJEHDHCA\JEHIID	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8	D87270D0039ED3A5A72E7082EA71E305	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	E113C02773BE81D3C280B225C06A3655	F01C16E165703E9F97C726AECF2CE956CAB2C3D9	5D7D8A8AE4AFA4CC5872303C20186CC1DF574E75A323D9DD2AC9A6AD47AED049
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqls[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	90E744829865D57082A7F452EDC90DE5	833B178775F39675FA4E55EAB1032353514E1052	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550

Windows Analysis Report
file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
file.exe

Malware Threat Intel
Provided by