Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1461134 |
| MD5: | 200f9f4aacee6abe76ff4c56869aa836 |
| SHA1: | 582e3099dba8aec26548d211ad6c3d8b5e5b6ab4 |
| SHA256: | 57bd105185f5216245ff7a967967fb191159828a9f918ece31b48030119aad52 |
| Tags: | exe |
| Infos: |   |
 | |
Detection
RisePro Stealer
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected RisePro Stealer
AI detected suspicious sample
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject threads in other processes
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found decision node followed by non-executed suspicious APIs
Found evasive API chain (date check)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Classification
- System is w10x64
file.exe (PID: 6332 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 200F9F4AACEE6ABE76FF4C56869AA836) 
schtasks.exe (PID: 4476 cmdline: schtasks / create /f /RU "user" /tr "C:\P rogramData \MPGPH131\ MPGPH131.e xe" /tn "M PGPH131 HR " /sc HOUR LY /rl HIG HEST MD5: 48C2FE20575769DE916F48EF0676A965) 
conhost.exe (PID: 1612 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 2336 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MPGPH131\ MPGPH131.e xe" /tn "M PGPH131 LG " /sc ONLO GON /rl HI GHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 5224 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WerFault.exe (PID: 6108 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 332 -s 192 0 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- MPGPH131.exe (PID: 432 cmdline:
C:\Program Data\MPGPH 131\MPGPH1 31.exe MD5: 200F9F4AACEE6ABE76FF4C56869AA836)
- MPGPH131.exe (PID: 6324 cmdline:
C:\Program Data\MPGPH 131\MPGPH1 31.exe MD5: 200F9F4AACEE6ABE76FF4C56869AA836)
- RageMP131.exe (PID: 4916 cmdline:
"C:\Users\ user\AppDa ta\Local\R ageMP131\R ageMP131.e xe" MD5: 200F9F4AACEE6ABE76FF4C56869AA836)
- RageMP131.exe (PID: 1448 cmdline:
"C:\Users\ user\AppDa ta\Local\R ageMP131\R ageMP131.e xe" MD5: 200F9F4AACEE6ABE76FF4C56869AA836)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| Click to see the 1 entries | ||||
System Summary |   |
|---|
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Timestamp: | 06/22/24-22:55:23.960247 |
| SID: | 2046269 |
| Source Port: | 49738 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:56:52.783227 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49753 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:56:24.564246 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49752 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:56:59.648082 |
| SID: | 2046269 |
| Source Port: | 49752 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:56:31.171917 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49753 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:56:52.419694 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49752 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:56:34.334522 |
| SID: | 2046269 |
| Source Port: | 49753 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:54:16.496660 |
| SID: | 2049060 |
| Source Port: | 49738 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:54:25.279747 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49738 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/22/24-22:54:17.088231 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49738 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Code function: | 0_2_004C6B00 | |
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_004C6000 | |
| Source: | Code function: | 0_2_004E6770 | |
| Source: | Code function: | 0_2_00493F40 | |
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Code function: | 0_2_00431F9C | |
| Source: | Code function: | 0_2_00432022 | |
| Source: | Code function: | 0_2_004E67A8 | |
| Source: | Code function: | 0_2_004938D0 | |
Networking | |
|---|
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_004C8590 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_004E5FF0 | |
System Summary | |
|---|
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_0044002D | |
| Source: | Code function: | 0_2_004DF030 | |
| Source: | Code function: | 0_2_0049F0D0 | |
| Source: | Code function: | 0_2_004AA200 | |
| Source: | Code function: | 0_2_0049D3A0 | |
| Source: | Code function: | 0_2_004963B0 | |
| Source: | Code function: | 0_2_00490440 | |
| Source: | Code function: | 0_2_004DE430 | |
| Source: | Code function: | 0_2_0053F550 | |
| Source: | Code function: | 0_2_004D7600 | |
| Source: | Code function: | 0_2_004986B0 | |
| Source: | Code function: | 0_2_0040B8E0 | |
| Source: | Code function: | 0_2_00481C10 | |
| Source: | Code function: | 0_2_004FAD00 | |
| Source: | Code function: | 0_2_00493F40 | |
| Source: | Code function: | 0_2_0049AF60 | |
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Code function: | 0_2_00493080 | |
| Source: | Code function: | 0_2_004371A0 | |
| Source: | Code function: | 0_2_0044036F | |
| Source: | Code function: | 0_2_004A4320 | |
| Source: | Code function: | 0_2_004845E0 | |
| Source: | Code function: | 0_2_0042F580 | |
| Source: | Code function: | 0_2_004A3610 | |
| Source: | Code function: | 0_2_005486C0 | |
| Source: | Code function: | 0_2_00547760 | |
| Source: | Code function: | 0_2_004E77E0 | |
| Source: | Code function: | 0_2_004547BF | |
| Source: | Code function: | 0_2_0043C960 | |
| Source: | Code function: | 0_2_0043A928 | |
| Source: | Code function: | 0_2_0044DA86 | |
| Source: | Code function: | 0_2_00458BB0 | |
| Source: | Code function: | 0_2_004EEC40 | |
| Source: | Code function: | 0_2_004EFC40 | |
| Source: | Code function: | 0_2_00534D40 | |
| Source: | Code function: | 0_2_00546D20 | |
| Source: | Code function: | 0_2_00545DE0 | |
| Source: | Code function: | 0_2_00458E30 | |
| Source: | Code function: | 0_2_00541F00 | |
| Source: | Code function: | 0_2_004F2FD0 | |
| Source: | Code function: | ||
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_004CF280 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00433F6C | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Process created: | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Stalling execution: | graph_0-53688 | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Decision node followed by non-executed suspicious API: | graph_0-53688 | ||
| Source: | Evasive API call chain: | graph_0-53803 | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_004C6000 | |
| Source: | Code function: | 0_2_004E6770 | |
| Source: | Code function: | 0_2_00493F40 | |
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Code function: | 0_2_00431F9C | |
| Source: | Code function: | 0_2_00432022 | |
| Source: | Code function: | 0_2_004E67A8 | |
| Source: | Code function: | 0_2_004938D0 | |
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00438A64 | |
| Source: | Code function: | 0_2_004CF280 | |
| Source: | Code function: | 0_2_004C6D80 | |
| Source: | Code function: | 0_2_00493F40 | |
| Source: | Code function: | 0_2_004E9A70 | |
| Source: | Code function: | 0_2_0043451D | |
| Source: | Code function: | 0_2_00438A64 | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Code function: | 0_2_004CF280 | |
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Code function: | 0_2_004531CA | |
| Source: | Code function: | 0_2_0044B1B1 | |
| Source: | Code function: | 0_2_004532F3 | |
| Source: | Code function: | 0_2_004533F9 | |
| Source: | Code function: | 0_2_004534CF | |
| Source: | Code function: | 0_2_0044B734 | |
| Source: | Code function: | 0_2_00452B5A | |
| Source: | Code function: | 0_2_00452D5F | |
| Source: | Code function: | 0_2_00452E51 | |
| Source: | Code function: | 0_2_00452E06 | |
| Source: | Code function: | 0_2_00452EEC | |
| Source: | Code function: | 0_2_00452F77 | |
| Source: | Registry key value queried: | Jump to behavior | ||
| Source: | Registry key value queried: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Code function: | 0_2_004DFF00 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | 1 OS Credential Dumping | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | 1 Scheduled Task/Job | 11 Process Injection | 3 Obfuscated Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 2 Data from Local System | 21 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 1 Scheduled Task/Job | 1 Registry Run Keys / Startup Folder | 1 Scheduled Task/Job | 2 Software Packing | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | 1 Screen Capture | 1 Non-Standard Port | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 Registry Run Keys / Startup Folder | 1 DLL Side-Loading | NTDS | 35 System Information Discovery | Distributed Component Object Model | 1 Email Collection | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Masquerading | LSA Secrets | 351 Security Software Discovery | SSH | Keylogging | 13 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 13 Virtualization/Sandbox Evasion | Cached Domain Credentials | 13 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 11 Process Injection | DCSync | 2 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | Indicator Removal from Tools | Proc Filesystem | 1 System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Network Configuration Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 53% | ReversingLabs | Win32.Trojan.RiseProStealer | ||
| 58% | Virustotal | Browse | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML | |||
| 53% | ReversingLabs | Win32.Trojan.RiseProStealer | ||
| 53% | ReversingLabs | Win32.Trojan.RiseProStealer |
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 23% | Virustotal | Browse | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 23% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 1% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| ipinfo.io | 34.117.186.192 | true | false |
| unknown |
| db-ip.com | 104.26.4.15 | true | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 34.117.186.192 | ipinfo.io | United States | 139070 | GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | false | |
| 104.26.4.15 | db-ip.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 77.91.77.66 | unknown | Russian Federation | 42861 | FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1461134 |
| Start date and time: | 2024-06-22 22:52:06 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 10m 40s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 17 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@12/31@3/3 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 20.189.173.20
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target MPGPH131.exe, PID 432 because there are no executed function
- Execution Graph export aborted for target MPGPH131.exe, PID 6324 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report creation exceeded maximum time and may have missing disassembly code information.
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtCreateFile calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 16:55:21 | API Interceptor | |
| 16:56:05 | API Interceptor | |
| 21:54:17 | Task Scheduler | |
| 21:54:17 | Task Scheduler | |
| 21:54:18 | Autostart | |
| 21:54:27 | Autostart |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 34.117.186.192 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Planet Stealer | Browse |
| ||
| Get hash | malicious | Planet Stealer | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 104.26.4.15 | Get hash | malicious | Nemty, Xmrig | Browse |
| |
| 77.91.77.66 | Get hash | malicious | RisePro Stealer | Browse | ||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | Amadey, RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ipinfo.io | Get hash | malicious | RisePro Stealer | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Amadey, RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | LummaC, RisePro Stealer, Vidar | Browse |
| ||
| db-ip.com | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Amadey, RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | LummaC, RisePro Stealer, Vidar | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU | Get hash | malicious | LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine | Browse |
| |
| Get hash | malicious | Amadey | Browse |
| ||
| Get hash | malicious | RedLine | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Amadey, RisePro Stealer | Browse |
| ||
| GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Blank Grabber | Browse |
| ||
| Get hash | malicious | Python Stealer, CStealer | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Bazar Loader, BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | Bazar Loader, BruteRatel, Latrodectus | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
⊘No context
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3329552 |
| Entropy (8bit): | 7.962033034801858 |
| Encrypted: | false |
| SSDEEP: | 98304:BWs3Yh0MA6vUsHAMd57XgfynxOGBsBBbDvq:BWsoh0kvFFgf6RsBBbjq |
| MD5: | 200F9F4AACEE6ABE76FF4C56869AA836 |
| SHA1: | 582E3099DBA8AEC26548D211AD6C3D8B5E5B6AB4 |
| SHA-256: | 57BD105185F5216245FF7A967967FB191159828A9F918ECE31B48030119AAD52 |
| SHA-512: | 27FF20213A73EC3A4FFAE79DBC424DC24061F019C0D860D98DF50D3DE07F6D95D19B1D54FA24FB6638A7FBCAA259FCFDC5AF954069EA05EBBB68DF572423062B |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_ee875fea51fd677b6244cbbfce203f99c672fd1e_2b1844b5_53e0877d-73ea-4182-a226-aef0b3a36460\Report.wer 
Download File
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 65536 |
| Entropy (8bit): | 1.0429828005402146 |
| Encrypted: | false |
| SSDEEP: | 192:WtdAUBuG+vPPuY0C2CvkXI3jyZrosLZuzuiFKZ24IO8eBP:y3QPGzClvkAjyuzuiFKY4IO8eP |
| MD5: | B8DB9A234490121E9FF1E4D95CB5B0DA |
| SHA1: | 9FD89EA5F6EC22B8262F54981C94EE6B095E0DFC |
| SHA-256: | 9442308B33BFC02052F59F544D506AB52B1E2BA590BC7DAF298B333085D0B0AF |
| SHA-512: | E4DE58A07A05DC5021F7F73DD59BC101BEDE531E61656BBFB6528C4B7A61B9B4CEFDE4C49F54C247AB5DE00A17B0B17AE6D4311E9829704FE8EAC5F4B1200D12 |
| Malicious: | true |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 104356 |
| Entropy (8bit): | 2.0451293197880056 |
| Encrypted: | false |
| SSDEEP: | 384:AmU+ixQexVFtvLXoNkLs0zz0P14Td/GJvLp3MC9jTD7obS6b6Nd9tN9qtNdqf4D5:AU6Q+VFtvhvx/evV9V34DqU |
| MD5: | 528AC3D1E53A214A9BAB45F7CBD9BDC7 |
| SHA1: | 4B4DB736BA683C9BAFE839EE64F0FA53A7E57710 |
| SHA-256: | B9907CD8609E6150BA9619C27DA47497B19CF659746DBC647A3F4C8F9997DE9D |
| SHA-512: | F6FDD8C10F1F5452790702205ED32C54D50D6B5A7CA19EDB592FC73477920A80CE091BFBC3DD0C49B8EBFEB2B6C1B57EEE514C9355254151C29A9973E17921AD |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8376 |
| Entropy (8bit): | 3.697199979345875 |
| Encrypted: | false |
| SSDEEP: | 192:R6l7wVeJcCv6vR3Abz6Y9YSU6gmfBjJJpY9pra89bbZsfrNpm:R6lXJL6vxAbz6YSSU6gmf1JJ2jbyfO |
| MD5: | 903E0B80169D4846A07F33A8C5B99B2F |
| SHA1: | E43A58AABBB88D7C0BCFA50F2D0D7459E46D365A |
| SHA-256: | F775D3AB7A85305906274B1E62E9156D6BC5E9E82A8505D5C6AD540E8230FC94 |
| SHA-512: | C94DA5B96ADA4199B3C6EF9F0DD60ABE6DCC31CFAADFD15A7946F4E19F2D383A9A6CD4FBCD684D635B38D8C55B3045E80E689B604143BAAE01D4FAC469507FDB |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4683 |
| Entropy (8bit): | 4.492245951583203 |
| Encrypted: | false |
| SSDEEP: | 48:cvIwWl8zsENJg77aI9XjiTlWpW8VY/Ym8M4JD3FJA+q8ru186CdPud:uIjfEnI7R+TU7V7JEH8RdPud |
| MD5: | 0104BB34325E1379F059D04530E0999D |
| SHA1: | 76561CDEED0B4698A03BFDAF0DDF7B66386D55B7 |
| SHA-256: | 94A5E195A886B33831620F6059C0D366ED1B6C01ADB79DA243DCE9DDD935A0E9 |
| SHA-512: | 8CC77F66D743199D07FA7EED06905B792F759905CC5928BE6AF554C86B8CC5C9FAED15C164DF02985335FCBF12AE3A06590C631A8648833C7D88A28166B39F5A |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3329552 |
| Entropy (8bit): | 7.962033034801858 |
| Encrypted: | false |
| SSDEEP: | 98304:BWs3Yh0MA6vUsHAMd57XgfynxOGBsBBbDvq:BWsoh0kvFFgf6RsBBbjq |
| MD5: | 200F9F4AACEE6ABE76FF4C56869AA836 |
| SHA1: | 582E3099DBA8AEC26548D211AD6C3D8B5E5B6AB4 |
| SHA-256: | 57BD105185F5216245FF7A967967FB191159828A9F918ECE31B48030119AAD52 |
| SHA-512: | 27FF20213A73EC3A4FFAE79DBC424DC24061F019C0D860D98DF50D3DE07F6D95D19B1D54FA24FB6638A7FBCAA259FCFDC5AF954069EA05EBBB68DF572423062B |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 5454 |
| Entropy (8bit): | 7.896443183337605 |
| Encrypted: | false |
| SSDEEP: | 96:JWGzqeAoMq+YK0KF8cAJiI2i+uJtS7TxKmEwe9Jkm623KJ0y:9qASpF8wFas8brJjj6Jb |
| MD5: | AC5C366B8ED524A59588CEE20AA2ED43 |
| SHA1: | 8A596B98BBBD5C3E5487389622D8A951DEB964AE |
| SHA-256: | 9BB463F7C66938E7D039A447BD0B7605A25301648D4B953C62B434F81DF98CFD |
| SHA-512: | 595EB13303AA5393512FE86932B2E497C0C84CC00E3F6015CABB5352807AD1E218CF2E8984341B651362D3B084173E40137EEA145BC20C75B9EDA725D9F469D1 |
| Malicious: | true |
| Yara Hits: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13 |
| Entropy (8bit): | 2.8150724101159437 |
| Encrypted: | false |
| SSDEEP: | 3:LEAVq:IZ |
| MD5: | DDCC5F9DAF4C890D94FDD66ECB713D86 |
| SHA1: | BFFA49A6128BB8D25147663042E9405E4AA10094 |
| SHA-256: | 069B1F4F76B58B3A41196B63596E8642BCF81C78120A5A8E923E06E8F367125D |
| SHA-512: | 2C2A5BD924A004E12360B8FA677BC0A47CB04521A9F1673E5C4107B073D3B87E9D24A9058EDAD0F8731DEBD1EAE04AF1A096A4A0D4662079B3B3B88196C8CDA3 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 98304 |
| Entropy (8bit): | 0.08235737944063153 |
| Encrypted: | false |
| SSDEEP: | 12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO |
| MD5: | 369B6DD66F1CAD49D0952C40FEB9AD41 |
| SHA1: | D05B2DE29433FB113EC4C558FF33087ED7481DD4 |
| SHA-256: | 14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D |
| SHA-512: | 771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5242880 |
| Entropy (8bit): | 0.037963276276857943 |
| Encrypted: | false |
| SSDEEP: | 192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ |
| MD5: | C0FDF21AE11A6D1FA1201D502614B622 |
| SHA1: | 11724034A1CC915B061316A96E79E9DA6A00ADE8 |
| SHA-256: | FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC |
| SHA-512: | A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 106496 |
| Entropy (8bit): | 1.1358696453229276 |
| Encrypted: | false |
| SSDEEP: | 192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544 |
| MD5: | 28591AA4E12D1C4FC761BE7C0A468622 |
| SHA1: | BC4968A84C19377D05A8BB3F208FBFAC49F4820B |
| SHA-256: | 51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9 |
| SHA-512: | 5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 106496 |
| Entropy (8bit): | 1.1358696453229276 |
| Encrypted: | false |
| SSDEEP: | 192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544 |
| MD5: | 28591AA4E12D1C4FC761BE7C0A468622 |
| SHA1: | BC4968A84C19377D05A8BB3F208FBFAC49F4820B |
| SHA-256: | 51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9 |
| SHA-512: | 5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40960 |
| Entropy (8bit): | 0.8553638852307782 |
| Encrypted: | false |
| SSDEEP: | 48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil |
| MD5: | 28222628A3465C5F0D4B28F70F97F482 |
| SHA1: | 1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14 |
| SHA-256: | 93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4 |
| SHA-512: | C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 28672 |
| Entropy (8bit): | 2.5793180405395284 |
| Encrypted: | false |
| SSDEEP: | 96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz |
| MD5: | 41EA9A4112F057AE6BA17E2838AEAC26 |
| SHA1: | F2B389103BFD1A1A050C4857A995B09FEAFE8903 |
| SHA-256: | CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB |
| SHA-512: | 29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5242880 |
| Entropy (8bit): | 0.037963276276857943 |
| Encrypted: | false |
| SSDEEP: | 192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ |
| MD5: | C0FDF21AE11A6D1FA1201D502614B622 |
| SHA1: | 11724034A1CC915B061316A96E79E9DA6A00ADE8 |
| SHA-256: | FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC |
| SHA-512: | A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114688 |
| Entropy (8bit): | 0.9746603542602881 |
| Encrypted: | false |
| SSDEEP: | 192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn |
| MD5: | 780853CDDEAEE8DE70F28A4B255A600B |
| SHA1: | AD7A5DA33F7AD12946153C497E990720B09005ED |
| SHA-256: | 1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3 |
| SHA-512: | E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40960 |
| Entropy (8bit): | 0.8553638852307782 |
| Encrypted: | false |
| SSDEEP: | 48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil |
| MD5: | 28222628A3465C5F0D4B28F70F97F482 |
| SHA1: | 1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14 |
| SHA-256: | 93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4 |
| SHA-512: | C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 106496 |
| Entropy (8bit): | 1.1358696453229276 |
| Encrypted: | false |
| SSDEEP: | 192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544 |
| MD5: | 28591AA4E12D1C4FC761BE7C0A468622 |
| SHA1: | BC4968A84C19377D05A8BB3F208FBFAC49F4820B |
| SHA-256: | 51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9 |
| SHA-512: | 5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49152 |
| Entropy (8bit): | 0.8180424350137764 |
| Encrypted: | false |
| SSDEEP: | 96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG |
| MD5: | 349E6EB110E34A08924D92F6B334801D |
| SHA1: | BDFB289DAFF51890CC71697B6322AA4B35EC9169 |
| SHA-256: | C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A |
| SHA-512: | 2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114688 |
| Entropy (8bit): | 0.9746603542602881 |
| Encrypted: | false |
| SSDEEP: | 192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn |
| MD5: | 780853CDDEAEE8DE70F28A4B255A600B |
| SHA1: | AD7A5DA33F7AD12946153C497E990720B09005ED |
| SHA-256: | 1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3 |
| SHA-512: | E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 126976 |
| Entropy (8bit): | 0.47147045728725767 |
| Encrypted: | false |
| SSDEEP: | 96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u |
| MD5: | A2D1F4CF66465F9F0CAC61C4A95C7EDE |
| SHA1: | BA6A845E247B221AAEC96C4213E1FD3744B10A27 |
| SHA-256: | B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE |
| SHA-512: | C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 159744 |
| Entropy (8bit): | 0.7873599747470391 |
| Encrypted: | false |
| SSDEEP: | 96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v |
| MD5: | 6A6BAD38068B0F6F2CADC6464C4FE8F0 |
| SHA1: | 4E3B235898D8E900548613DDB6EA59CDA5EB4E68 |
| SHA-256: | 0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982 |
| SHA-512: | BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 126976 |
| Entropy (8bit): | 0.47147045728725767 |
| Encrypted: | false |
| SSDEEP: | 96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u |
| MD5: | A2D1F4CF66465F9F0CAC61C4A95C7EDE |
| SHA1: | BA6A845E247B221AAEC96C4213E1FD3744B10A27 |
| SHA-256: | B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE |
| SHA-512: | C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 159744 |
| Entropy (8bit): | 0.7873599747470391 |
| Encrypted: | false |
| SSDEEP: | 96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v |
| MD5: | 6A6BAD38068B0F6F2CADC6464C4FE8F0 |
| SHA1: | 4E3B235898D8E900548613DDB6EA59CDA5EB4E68 |
| SHA-256: | 0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982 |
| SHA-512: | BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114688 |
| Entropy (8bit): | 0.9746603542602881 |
| Encrypted: | false |
| SSDEEP: | 192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn |
| MD5: | 780853CDDEAEE8DE70F28A4B255A600B |
| SHA1: | AD7A5DA33F7AD12946153C497E990720B09005ED |
| SHA-256: | 1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3 |
| SHA-512: | E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6085 |
| Entropy (8bit): | 6.038274200863744 |
| Encrypted: | false |
| SSDEEP: | 96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY |
| MD5: | ACB5AD34236C58F9F7D219FB628E3B58 |
| SHA1: | 02E39404CA22F1368C46A7B8398F5F6001DB8F5C |
| SHA-256: | 05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1 |
| SHA-512: | 5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5085 |
| Entropy (8bit): | 5.373584115099081 |
| Encrypted: | false |
| SSDEEP: | 96:xhAhRRuCWcT4Aisph892DDowu4mmngvANUbg3x:xuECWvAtphw2DDoXFmXB |
| MD5: | 2EF833C95FF4A45CB47D7BE17FE6BA31 |
| SHA1: | D770AEBC57500FABFD792A1C8429546629BC1B46 |
| SHA-256: | 32E6C4F794C1255F0E96E57D222F03AE2A79E75D22D000006E328C13E0CAB989 |
| SHA-512: | 1BA0227F33D58A1063411F9F22055685DC0A9389B2FE2B5019414FF4FF2AE463FCB5A79E2ECC17295D3CCDA56853455FC157D1E229FF4D6E97E6A8A5B0B3EDDB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4897 |
| Entropy (8bit): | 2.518316437186352 |
| Encrypted: | false |
| SSDEEP: | 48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q |
| MD5: | B3E9D0E1B8207AA74CB8812BAAF52EAE |
| SHA1: | A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B |
| SHA-256: | 4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C |
| SHA-512: | B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1835008 |
| Entropy (8bit): | 4.465826346426732 |
| Encrypted: | false |
| SSDEEP: | 6144:kIXfpi67eLPU9skLmb0b4iWSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbN:ZXD94iWlLZMM6YFH1+N |
| MD5: | BF196CFB4D522EB9412E84579C3FCECF |
| SHA1: | E0FE5C9566129E46105FDAEEE0240949000323E3 |
| SHA-256: | 6EC1D00D859FFAC93CF1038280A5DE7A38782FB3FD2749CA25B3BF62F7C4E069 |
| SHA-512: | 417FD437D3452A56653569FD5B6F986035D8DF2A473180364EDE11002CEDCD5E66AB2EF8E6F507C66D1CCD4CD8661CB4B81F161CB6DDCD36E8EA5AACA779B402 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.962033034801858 |
| TrID: |
|
| File name: | file.exe |
| File size: | 3'329'552 bytes |
| MD5: | 200f9f4aacee6abe76ff4c56869aa836 |
| SHA1: | 582e3099dba8aec26548d211ad6c3d8b5e5b6ab4 |
| SHA256: | 57bd105185f5216245ff7a967967fb191159828a9f918ece31b48030119aad52 |
| SHA512: | 27ff20213a73ec3a4ffae79dbc424dc24061f019c0d860d98df50d3de07f6d95d19b1d54fa24fb6638a7fbcaa259fcfdc5af954069ea05ebbb68df572423062b |
| SSDEEP: | 98304:BWs3Yh0MA6vUsHAMd57XgfynxOGBsBBbDvq:BWsoh0kvFFgf6RsBBbjq |
| TLSH: | 34F53327B5C04CB9C9B20BFBBC53094D5E4FAA6587119325B53F8ADD312C48D8BF25A8 |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s |
 | |
| Icon Hash: | 8596a1a0a1a1b171 |
| Entrypoint: | 0x980058 |
| Entrypoint Section: | .boot |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x664C6914 [Tue May 21 09:27:48 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 63814aaf116ba6abb6496ce4bcad24c6 |
| Instruction |
|---|
| call 00007FD844834FF0h |
| push ebx |
| mov ebx, esp |
| push ebx |
| mov esi, dword ptr [ebx+08h] |
| mov edi, dword ptr [ebx+10h] |
| cld |
| mov dl, 80h |
| mov al, byte ptr [esi] |
| inc esi |
| mov byte ptr [edi], al |
| inc edi |
| mov ebx, 00000002h |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jnc 00007FD844834E8Ch |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jnc 00007FD844834EF3h |
| xor eax, eax |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jnc 00007FD844834F87h |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| je 00007FD844834EAAh |
| push edi |
| mov eax, eax |
| sub edi, eax |
| mov al, byte ptr [edi] |
| pop edi |
| mov byte ptr [edi], al |
| inc edi |
| mov ebx, 00000002h |
| jmp 00007FD844834E3Bh |
| mov eax, 00000001h |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jc 00007FD844834E8Ch |
| sub eax, ebx |
| mov ebx, 00000001h |
| jne 00007FD844834ECAh |
| mov ecx, 00000001h |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc ecx, ecx |
| add dl, dl |
| jne 00007FD844834EA7h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jc 00007FD844834E8Ch |
| push esi |
| mov esi, edi |
| sub esi, ebp |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x19618b | 0x184 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x18a000 | 0x1638 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x7f6000 | 0x10 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x197018 | 0x18 | .tls |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x18369c | 0x40 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| 0x1000 | 0x15bbc8 | 0x9d200 | 2ba7a0fbdd34a17b90ad60eb025031e4 | False | 0.997961416070008 | data | 7.970562796260684 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | |
| 0x15d000 | 0x27e32 | 0x10a00 | 99bc1ff5a03860a11215e62849ac2787 | False | 0.9927895911654135 | data | 7.945549630166553 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | |
| 0x185000 | 0x4930 | 0x800 | f146833fa0e788ef058e7854601d79a5 | False | 0.99267578125 | data | 7.793978096287101 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| .rsrc | 0x18a000 | 0x1638 | 0x1800 | fe6f3fdb9e7e97cba92d8ce4e4fcc95b | False | 0.7220052083333334 | data | 6.54017046361188 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| 0x18c000 | 0x9858 | 0x7200 | 8d5731a433ff8d49f45fa55aee3d50c4 | False | 0.9794750548245614 | data | 7.93307183804952 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | |
| .idata | 0x196000 | 0x1000 | 0x400 | 1b20e07443fa333ff9692026d1e6c6c2 | False | 0.3984375 | data | 3.42439969016873 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x197000 | 0x1000 | 0x200 | 54a50a058e0f3b6aa2fe1b22e2033106 | False | 0.056640625 | data | 0.18120187678200297 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .themida | 0x198000 | 0x3e8000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .boot | 0x580000 | 0x275600 | 0x275600 | 8761b4811e06c893b0d9359c8d51b7db | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .reloc | 0x7f6000 | 0x1000 | 0x10 | f5bc99b71bad9e8a775cc32747e3ca58 | False | 1.5 | GLS_BINARY_LSB_FIRST | 2.474601752714581 | IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x18a440 | 0x1060 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | Russian | Russia | 0.8838263358778626 |
| RT_GROUP_ICON | 0x18b4a0 | 0x14 | data | Russian | Russia | 1.05 |
| RT_VERSION | 0x18a130 | 0x310 | data | Russian | Russia | 0.45408163265306123 |
| RT_MANIFEST | 0x18b4b8 | 0x17d | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5931758530183727 |
| DLL | Import |
|---|---|
| kernel32.dll | GetModuleHandleA |
| USER32.dll | wsprintfA |
| GDI32.dll | CreateCompatibleBitmap |
| ADVAPI32.dll | RegQueryValueExA |
| SHELL32.dll | ShellExecuteA |
| ole32.dll | CoInitialize |
| WS2_32.dll | WSAStartup |
| CRYPT32.dll | CryptUnprotectData |
| SHLWAPI.dll | PathFindExtensionA |
| gdiplus.dll | GdipGetImageEncoders |
| SETUPAPI.dll | SetupDiEnumDeviceInfo |
| ntdll.dll | RtlUnicodeStringToAnsiString |
| RstrtMgr.DLL | RmStartSession |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Russian | Russia |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Protocol | SID | Message | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 06/22/24-22:55:23.960247 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/22/24-22:56:52.783227 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| 06/22/24-22:56:24.564246 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| 06/22/24-22:56:59.648082 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/22/24-22:56:31.171917 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| 06/22/24-22:56:52.419694 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| 06/22/24-22:56:34.334522 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/22/24-22:54:16.496660 | TCP | 2049060 | ET TROJAN RisePro TCP Heartbeat Packet | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/22/24-22:54:25.279747 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| 06/22/24-22:54:17.088231 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jun 22, 2024 22:54:16.475754976 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:16.481462002 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:16.481628895 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:16.496659994 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:16.502367020 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:17.088231087 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:17.131715059 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:20.225563049 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:20.230835915 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:25.279747009 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:25.397953987 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:25.398063898 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:25.398144007 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:25.399310112 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:25.399390936 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:25.444474936 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:25.881417990 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:25.881747961 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:25.883452892 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:25.883517027 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:25.884640932 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:25.926302910 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:25.972538948 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.076378107 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.076716900 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.076797962 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:26.079888105 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:26.079937935 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.079993963 CEST | 49739 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:54:26.080010891 CEST | 443 | 49739 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.095294952 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.095385075 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.095555067 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.096038103 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.096127033 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.566569090 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.566700935 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.587281942 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.587354898 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.588401079 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.590306997 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.636606932 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.781589031 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.781680107 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.781959057 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.782721043 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.782721996 CEST | 49740 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:54:26.782794952 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.782833099 CEST | 443 | 49740 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.783025980 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:26.788134098 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:28.024004936 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:28.241272926 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:30.487631083 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:30.506927013 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:30.512902975 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:32.497445107 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:32.538132906 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:32.585098982 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:32.592430115 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.955744028 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.955809116 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.955847979 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.955885887 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956084967 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:33.956157923 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956192017 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956224918 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956238985 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:33.956263065 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956291914 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956326008 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956365108 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956394911 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956427097 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:33.956453085 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:33.956605911 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956634998 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956741095 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.956799030 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:33.961759090 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.961812973 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.961853027 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:33.961898088 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:33.961992025 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:34.073458910 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:34.073513031 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:34.073554039 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:34.073611021 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:34.074398041 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:34.074640989 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:34.078457117 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:34.116439104 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:34.122153997 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:49.530035019 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:49.600614071 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:49.606075048 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:54:52.648143053 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:54:52.653721094 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:23.960247040 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:55:23.966305971 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:26.450154066 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:26.538218975 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:55:27.731662989 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:55:27.731736898 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:55:27.736721039 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:27.736785889 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:27.736818075 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:27.736845970 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:27.736893892 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:55:27.736983061 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:27.737075090 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:27.742288113 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:30.788368940 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:55:30.794229031 CEST | 58709 | 49738 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:55:30.794547081 CEST | 49738 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:23.960170031 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:23.965480089 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:23.965574980 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:23.987380028 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:23.992584944 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:24.564245939 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:24.741734028 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:27.679461956 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:27.684664965 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:30.499641895 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:30.504719019 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:30.504889011 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:30.520092964 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:30.525245905 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:31.171916962 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:31.366796970 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:34.334522009 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:34.339616060 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.419693947 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.513431072 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.513519049 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.513612986 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.514522076 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.514564037 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.538616896 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:52.783226967 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.821562052 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.821604013 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.821824074 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.822747946 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.822762966 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.866791010 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:52.973824978 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.974018097 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.975158930 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:52.975193024 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.975547075 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.015868902 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.056559086 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.144577026 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.144691944 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.144820929 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.145705938 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.145756960 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.145787001 CEST | 49754 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.145803928 CEST | 443 | 49754 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.147830009 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.147921085 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.148123980 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.148457050 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.148514986 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.287683964 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.287786007 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.289237022 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.289277077 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.289691925 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.337378025 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.384531021 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.476761103 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.477068901 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.477147102 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.477974892 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.478018999 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.478046894 CEST | 49755 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 22, 2024 22:56:53.478061914 CEST | 443 | 49755 | 34.117.186.192 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.480539083 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.480643034 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.480721951 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.481072903 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.481108904 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.608921051 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.609033108 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.610094070 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.610112906 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.610480070 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.611987114 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.656549931 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.836415052 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.836505890 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.836762905 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.836762905 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.836762905 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.837235928 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:53.842228889 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.977319956 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.977449894 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.978466988 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:53.978498936 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.979013920 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:53.982551098 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:54.024581909 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:54.184341908 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:54.184670925 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:54.184986115 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:54.184986115 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:54.184986115 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:54.185359001 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:54.190233946 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:54.213649035 CEST | 49756 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:54.213717937 CEST | 443 | 49756 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:54.679418087 CEST | 49757 | 443 | 192.168.2.4 | 104.26.4.15 |
| Jun 22, 2024 22:56:54.679483891 CEST | 443 | 49757 | 104.26.4.15 | 192.168.2.4 |
| Jun 22, 2024 22:56:56.509208918 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:56.652391911 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:56.731173038 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:56:56.866785049 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:59.648082018 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:56:59.653048038 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:57:03.972543955 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:57:04.007626057 CEST | 49752 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 22, 2024 22:57:04.012689114 CEST | 58709 | 49752 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:57:07.983200073 CEST | 58709 | 49753 | 77.91.77.66 | 192.168.2.4 |
| Jun 22, 2024 22:57:08.038644075 CEST | 49753 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jun 22, 2024 22:54:25.384589911 CEST | 62382 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jun 22, 2024 22:54:25.392137051 CEST | 53 | 62382 | 1.1.1.1 | 192.168.2.4 |
| Jun 22, 2024 22:54:26.082113028 CEST | 51848 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jun 22, 2024 22:54:26.094408035 CEST | 53 | 51848 | 1.1.1.1 | 192.168.2.4 |
| Jun 22, 2024 22:56:52.501929998 CEST | 62906 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jun 22, 2024 22:56:52.509466887 CEST | 53 | 62906 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jun 22, 2024 22:54:25.384589911 CEST | 192.168.2.4 | 1.1.1.1 | 0xb4d5 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jun 22, 2024 22:54:26.082113028 CEST | 192.168.2.4 | 1.1.1.1 | 0x39c5 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jun 22, 2024 22:56:52.501929998 CEST | 192.168.2.4 | 1.1.1.1 | 0x4fc4 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jun 22, 2024 22:54:25.392137051 CEST | 1.1.1.1 | 192.168.2.4 | 0xb4d5 | No error (0) | 34.117.186.192 | A (IP address) | IN (0x0001) | false | ||
| Jun 22, 2024 22:54:26.094408035 CEST | 1.1.1.1 | 192.168.2.4 | 0x39c5 | No error (0) | 104.26.4.15 | A (IP address) | IN (0x0001) | false | ||
| Jun 22, 2024 22:54:26.094408035 CEST | 1.1.1.1 | 192.168.2.4 | 0x39c5 | No error (0) | 104.26.5.15 | A (IP address) | IN (0x0001) | false | ||
| Jun 22, 2024 22:54:26.094408035 CEST | 1.1.1.1 | 192.168.2.4 | 0x39c5 | No error (0) | 172.67.75.166 | A (IP address) | IN (0x0001) | false | ||
| Jun 22, 2024 22:56:52.509466887 CEST | 1.1.1.1 | 192.168.2.4 | 0x4fc4 | No error (0) | 34.117.186.192 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 34.117.186.192 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-22 20:52:52 UTC | 59 | OUT | |
| 2024-06-22 20:52:52 UTC | 513 | IN | |
| 2024-06-22 20:52:52 UTC | 319 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49739 | 34.117.186.192 | 443 | 6332 | C:\Users\user\Desktop\file.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-22 20:54:25 UTC | 236 | OUT | |
| 2024-06-22 20:54:26 UTC | 514 | IN | |
| 2024-06-22 20:54:26 UTC | 876 | IN | |
| 2024-06-22 20:54:26 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49740 | 104.26.4.15 | 443 | 6332 | C:\Users\user\Desktop\file.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-22 20:54:26 UTC | 260 | OUT | |
| 2024-06-22 20:54:26 UTC | 655 | IN | |
| 2024-06-22 20:54:26 UTC | 673 | IN | |
| 2024-06-22 20:54:26 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49754 | 34.117.186.192 | 443 | 4916 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-22 20:56:53 UTC | 236 | OUT | |
| 2024-06-22 20:56:53 UTC | 514 | IN | |
| 2024-06-22 20:56:53 UTC | 876 | IN | |
| 2024-06-22 20:56:53 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49755 | 34.117.186.192 | 443 | 1448 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-22 20:56:53 UTC | 236 | OUT | |
| 2024-06-22 20:56:53 UTC | 514 | IN | |
| 2024-06-22 20:56:53 UTC | 876 | IN | |
| 2024-06-22 20:56:53 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49756 | 104.26.4.15 | 443 | 4916 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-22 20:56:53 UTC | 260 | OUT | |
| 2024-06-22 20:56:53 UTC | 653 | IN | |
| 2024-06-22 20:56:53 UTC | 673 | IN | |
| 2024-06-22 20:56:53 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49757 | 104.26.4.15 | 443 | 1448 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-22 20:56:53 UTC | 260 | OUT | |
| 2024-06-22 20:56:54 UTC | 655 | IN | |
| 2024-06-22 20:56:54 UTC | 673 | IN | |
| 2024-06-22 20:56:54 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 16:52:57 |
| Start date: | 22/06/2024 |
| Path: | C:\Users\user\Desktop\file.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'329'552 bytes |
| MD5 hash: | 200F9F4AACEE6ABE76FF4C56869AA836 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 16:54:15 |
| Start date: | 22/06/2024 |
| Path: | C:\Windows\SysWOW64\schtasks.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xb80000 |
| File size: | 187'904 bytes |
| MD5 hash: | 48C2FE20575769DE916F48EF0676A965 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 16:54:15 |
| Start date: | 22/06/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 16:54:15 |
| Start date: | 22/06/2024 |
| Path: | C:\Windows\SysWOW64\schtasks.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xb80000 |
| File size: | 187'904 bytes |
| MD5 hash: | 48C2FE20575769DE916F48EF0676A965 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 7 |
| Start time: | 16:54:15 |
| Start date: | 22/06/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 16:54:17 |
| Start date: | 22/06/2024 |
| Path: | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'329'552 bytes |
| MD5 hash: | 200F9F4AACEE6ABE76FF4C56869AA836 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 9 |
| Start time: | 16:54:17 |
| Start date: | 22/06/2024 |
| Path: | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'329'552 bytes |
| MD5 hash: | 200F9F4AACEE6ABE76FF4C56869AA836 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 11 |
| Start time: | 16:54:27 |
| Start date: | 22/06/2024 |
| Path: | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'329'552 bytes |
| MD5 hash: | 200F9F4AACEE6ABE76FF4C56869AA836 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 12 |
| Start time: | 16:54:35 |
| Start date: | 22/06/2024 |
| Path: | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'329'552 bytes |
| MD5 hash: | 200F9F4AACEE6ABE76FF4C56869AA836 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 15 |
| Start time: | 16:55:31 |
| Start date: | 22/06/2024 |
| Path: | C:\Windows\SysWOW64\WerFault.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x280000 |
| File size: | 483'680 bytes |
| MD5 hash: | C31336C1EFC2CCB44B4326EA793040F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 23.4% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 52.7% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 36 |
Graph
Function 004DFF00 Relevance: 98.4, APIs: 50, Strings: 4, Instructions: 3939registrytimefileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004AA200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00490440 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00493F40 Relevance: 26.5, APIs: 12, Strings: 2, Instructions: 1966fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E6770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E67A8 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 279fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C6D80 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004FAD00 Relevance: 9.2, Strings: 7, Instructions: 484COMMON
Download Yara Rule
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004DE430 Relevance: 8.2, APIs: 5, Instructions: 731fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044002D Relevance: .3, Instructions: 318COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E4720 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 291registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D6BA0 Relevance: 9.2, APIs: 6, Instructions: 164fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382libraryloadernetworkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00463830 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E6C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044B9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E57F0 Relevance: 3.4, APIs: 2, Instructions: 350COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004D65F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004C7EF0 Relevance: 1.9, APIs: 1, Instructions: 399COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00415350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E7640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E74C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004E5D00 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|