Windows Analysis Report
5IRIk4f1PO.exe

Overview

General Information

Sample name: 5IRIk4f1PO.exe
renamed because original name is a hash value
Original sample name: 9f3205479a5ff3acd9eafdb8eaa629e9.exe
Analysis ID: 1464556
MD5: 9f3205479a5ff3acd9eafdb8eaa629e9
SHA1: 0db77b61300e8e3ea19c8de71a078bb853e5166d
SHA256: 5c483ed90d904d0d81967c91ac431a2c27228fd9562dd2f2e3f003644c59076e
Tags: 32exe
Infos:

Detection

CryptOne, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Yara detected CryptOne packer
Yara detected Powershell download and execute
Yara detected Vidar stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://steamcommunity.com/profiles/76561199707802586 Avira URL Cloud: Label: malware
Source: https://t.me/g067n Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 5IRIk4f1PO.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetProcAddress
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: LoadLibraryA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: lstrcatA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: OpenEventA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CreateEventA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CloseHandle
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Sleep
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: VirtualFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetSystemInfo
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: VirtualAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: HeapAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetComputerNameA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: lstrcpyA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetProcessHeap
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetCurrentProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: lstrlenA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ExitProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetSystemTime
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: advapi32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: gdi32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: user32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: crypt32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ntdll.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetUserNameA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CreateDCA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetDeviceCaps
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ReleaseDC
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sscanf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: NtQueryInformationProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: VMwareVMware
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: HAL9TH
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: JohnDoe
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: DISPLAY
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetFileAttributesA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GlobalLock
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: HeapFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetFileSize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GlobalSize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: IsWow64Process
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Process32Next
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetLocalTime
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: FreeLibrary
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetVolumeInformationA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Process32First
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetLocaleInfoA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetModuleFileNameA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: DeleteFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: FindNextFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: LocalFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: FindClose
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: LocalAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetFileSizeEx
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ReadFile
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SetFilePointer
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: WriteFile
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CreateFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: FindFirstFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CopyFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: VirtualProtect
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetLastError
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: lstrcpynA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: MultiByteToWideChar
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GlobalFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: WideCharToMultiByte
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GlobalAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: OpenProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: TerminateProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetCurrentProcessId
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: gdiplus.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ole32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: bcrypt.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: wininet.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: shlwapi.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: shell32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: psapi.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: rstrtmgr.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SelectObject
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: BitBlt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: DeleteObject
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CreateCompatibleDC
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdiplusStartup
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdiplusShutdown
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdipDisposeImage
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GdipFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CoUninitialize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CoInitialize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CoCreateInstance
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: BCryptDecrypt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: BCryptSetProperty
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: BCryptDestroyKey
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetWindowRect
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetDesktopWindow
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetDC
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CloseWindow
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: wsprintfA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CharToOemW
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: wsprintfW
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RegQueryValueExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RegEnumKeyExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RegOpenKeyExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RegCloseKey
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RegEnumValueA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CryptUnprotectData
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SHGetFolderPathA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ShellExecuteExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: InternetOpenUrlA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: InternetConnectA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: InternetCloseHandle
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: InternetOpenA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: HttpSendRequestA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: HttpOpenRequestA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: InternetReadFile
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: InternetCrackUrlA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: StrCmpCA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: StrStrA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: StrCmpCW
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: PathMatchSpecA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RmStartSession
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RmRegisterResources
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RmGetList
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: RmEndSession
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_open
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_step
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_column_text
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_finalize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_close
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3_column_blob
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: encrypted_key
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: PATH
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: NSS_Init
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: NSS_Shutdown
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: PK11_FreeSlot
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: PK11_Authenticate
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: C:\ProgramData\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Soft:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: profile:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Host:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Login:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Password:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Opera
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: OperaGX
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Network
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Cookies
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: .txt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: TRUE
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: FALSE
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Autofill
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: History
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Name:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Month:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Year:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Card:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Cookies
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Login Data
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Web Data
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: History
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: logins.json
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: formSubmitURL
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: usernameField
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: encryptedUsername
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: encryptedPassword
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: guid
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: cookies.sqlite
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: formhistory.sqlite
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: places.sqlite
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Plugins
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Local Extension Settings
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Sync Extension Settings
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: IndexedDB
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Opera Stable
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Opera GX Stable
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: CURRENT
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: chrome-extension_
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Local State
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: profiles.ini
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: chrome
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: opera
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: firefox
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Wallets
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ProductName
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ProcessorNameString
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: DisplayName
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: DisplayVersion
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: freebl3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: mozglue.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: msvcp140.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: nss3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: softokn3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: vcruntime140.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \Temp\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: .exe
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: runas
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: open
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: /c start
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %DESKTOP%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %APPDATA%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %USERPROFILE%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %DOCUMENTS%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: %RECENT%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: *.lnk
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Files
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \discord\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \Telegram Desktop\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: key_datas
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: map*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Telegram
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: *.tox
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: *.ini
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Password
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: 00000001
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: 00000002
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: 00000003
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: 00000004
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Pidgin
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \.purple\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: accounts.xml
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: token:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Software\Valve\Steam
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: SteamPath
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \config\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ssfn*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: config.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: DialogConfig.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: libraryfolders.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: loginusers.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \Steam\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: sqlite3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: browsers
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: done
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Soft
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: https
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: POST
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: HTTP/1.1
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: hwid
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: build
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: token
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: file_name
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: file
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: message
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack String decryptor: screenshot.jpg
Uses 32bit PE files
Source: 5IRIk4f1PO.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor URLs: https://t.me/g067n
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49732 -> 195.201.251.214:9000
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: t.me
Source: kat6899.tmp, 00000001.00000003.1719247024.00000000009E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/
Source: kat6899.tmp, 00000001.00000003.1854190744.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000900000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enf
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000000.1651157970.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, kat6899.tmp.0.dr String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: 5IRIk4f1PO.exe String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/on-c
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types0
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types2u.dll
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesP
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/TypesStv4
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-c
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Typesxt_4
Source: kat6899.tmp, 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214/
Source: kat6899.tmp, 00000001.00000003.1694784942.0000000000917000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000
Source: kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.0000000000994000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1853991046.0000000000A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/0aosoft
Source: kat6899.tmp, 00000001.00000003.1854190744.000000000099C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1857143929.00000000009C6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/C
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000933000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/Mac
Source: kat6899.tmp, 00000001.00000003.1857143929.00000000009BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/d
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000950000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dllD
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000950000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dllet
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/freebl3.dlll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C1000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/k
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/l
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/nss3.dllm
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: kat6899.tmp, 00000001.00000003.1857143929.0000000000988000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1854190744.000000000097E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/sqlt.dllL
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/sqlt.dllV
Source: kat6899.tmp, 00000001.00000002.2914483011.00000000009C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll/
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllrv:129.0)
Source: kat6899.tmp, 00000001.00000003.1868797978.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1865603122.0000000000A26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000/xg
Source: kat6899.tmp, 00000001.00000002.2912988617.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:900010ale
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000g
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: DBKFHJ.1.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: DBKFHJ.1.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DBKFHJ.1.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DBKFHJ.1.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: DBKFHJ.1.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DBKFHJ.1.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DBKFHJ.1.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: kat6899.tmp, 00000001.00000003.1846693648.0000000000A22000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1836222806.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2917825020.000000001FF1D000.00000004.00000020.00020000.00000000.sdmp, GCFHDA.1.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: GCFHDA.1.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: kat6899.tmp, 00000001.00000003.1846693648.0000000000A22000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1836222806.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2917825020.000000001FF1D000.00000004.00000020.00020000.00000000.sdmp, GCFHDA.1.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GCFHDA.1.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.0000000000900000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1694784942.0000000000933000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1694784942.0000000000917000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067n
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000900000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067nr
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: kat6899.tmp, 00000001.00000003.1694784942.0000000000933000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: DBKFHJ.1.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: DBKFHJ.1.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2
Yara detected Keylogger Generic
Source: Yara match File source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR
Contains functionality to call native functions
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Code function: 0_2_02ADB510 NtProtectVirtualMemory,NtProtectVirtualMemory, 0_2_02ADB510
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Code function: 0_2_02ADBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_02ADBEF0
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Code function: 0_2_02ADB250 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification, 0_2_02ADB250
Detected potential crypto function
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Code function: 0_2_02ADC510 0_2_02ADC510
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20104CF0 1_2_20104CF0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2017A0B0 1_2_2017A0B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F209F 1_2_200F209F
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F47AF 1_2_200F47AF
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2011A560 1_2_2011A560
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201EA590 1_2_201EA590
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201066C0 1_2_201066C0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2022E800 1_2_2022E800
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F3E3B 1_2_200F3E3B
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F481D 1_2_200F481D
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2020A900 1_2_2020A900
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201EA940 1_2_201EA940
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201D69C0 1_2_201D69C0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200FAA40 1_2_200FAA40
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200FEA80 1_2_200FEA80
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F19DD 1_2_200F19DD
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_202CAEBE 1_2_202CAEBE
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20136E80 1_2_20136E80
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20152EE0 1_2_20152EE0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200FF160 1_2_200FF160
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F174E 1_2_200F174E
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20123370 1_2_20123370
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F251D 1_2_200F251D
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2011BAB0 1_2_2011BAB0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F290A 1_2_200F290A
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20218030 1_2_20218030
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20170090 1_2_20170090
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20178120 1_2_20178120
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F3AB2 1_2_200F3AB2
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20230480 1_2_20230480
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20118680 1_2_20118680
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20118763 1_2_20118763
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20154760 1_2_20154760
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20188760 1_2_20188760
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F1EF1 1_2_200F1EF1
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201F4A60 1_2_201F4A60
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20118D2A 1_2_20118D2A
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20109000 1_2_20109000
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20215040 1_2_20215040
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_202CD209 1_2_202CD209
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201853B0 1_2_201853B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F3580 1_2_200F3580
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20259430 1_2_20259430
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20199690 1_2_20199690
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201AD6D0 1_2_201AD6D0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F1C9E 1_2_200F1C9E
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201A5940 1_2_201A5940
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20219A20 1_2_20219A20
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F2018 1_2_200F2018
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F292D 1_2_200F292D
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20259CC0 1_2_20259CC0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F12A8 1_2_200F12A8
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F2AA9 1_2_200F2AA9
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\kat6899.tmp 6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: String function: 200F395E appears 78 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: String function: 200F3AF3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: String function: 200F1F5A appears 31 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: String function: 202D06B1 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: String function: 200F415B appears 133 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: String function: 200F1C2B appears 47 times
Sample file is different than original file name gathered from version info
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameResHack! vs 5IRIk4f1PO.exe
Uses 32bit PE files
Source: 5IRIk4f1PO.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/11@1/2
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\DGTGRKDF.htm Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe File created: C:\Users\user\AppData\Local\Temp\kat6899.tmp Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: kat6899.tmp, kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: kat6899.tmp, kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: kat6899.tmp, 00000001.00000003.1854190744.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1857049917.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, DAKJDA.1.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: kat6899.tmp, kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: unknown Process created: C:\Users\user\Desktop\5IRIk4f1PO.exe "C:\Users\user\Desktop\5IRIk4f1PO.exe"
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Process created: C:\Users\user\AppData\Local\Temp\kat6899.tmp C:\Users\user\AppData\Local\Temp\kat6899.tmp
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Process created: C:\Users\user\AppData\Local\Temp\kat6899.tmp C:\Users\user\AppData\Local\Temp\kat6899.tmp Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: cryptnet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: 5IRIk4f1PO.exe Static file information: File size 2288128 > 1048576
Source: 5IRIk4f1PO.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x127800
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr
PE file contains sections with non-standard names
Source: sqlt[1].dll.1.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Code function: 0_2_02ADCA10 push edx; ret 0_2_02ADCC1F
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Code function: 0_2_02ADC310 push edx; ret 0_2_02ADC31B
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F10C8 push ecx; ret 1_2_202F3552
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F1BF9 push ecx; ret 1_2_20294C03
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe File created: C:\Users\user\AppData\Local\Temp\kat6899.tmp Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: icon.png
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp API coverage: 0.8 %
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000090C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWH
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_200F2C8E
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F46A6 GetProcessHeap, 1_2_200F46A6
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_200F2C8E
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_200F42AF SetUnhandledExceptionFilter, 1_2_200F42AF

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Memory allocated: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Code function: 0_2_02ADBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 0_2_02ADBEF0
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 400000 value starts with: 4D5A Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Section unmapped: C:\Users\user\AppData\Local\Temp\kat6899.tmp base address: 400000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 425000 Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 42E000 Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 643000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe Process created: C:\Users\user\AppData\Local\Temp\kat6899.tmp C:\Users\user\AppData\Local\Temp\kat6899.tmp Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: EnumSystemLocalesW, 1_2_202E2CB6
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: EnumSystemLocalesW, 1_2_202E2D38
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: EnumSystemLocalesW, 1_2_202E2DF9
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 1_2_202E3300
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 1_2_200F3AA3
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: EnumSystemLocalesW, 1_2_202CFF17
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: GetLocaleInfoW, 1_2_200F2112
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: GetLocaleInfoW, 1_2_200F2112
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20294323 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 1_2_20294323
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_202D4A46 GetTimeZoneInformation, 1_2_202D4A46
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: kat6899.tmp, 00000001.00000002.2914483011.0000000000988000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1857143929.0000000000988000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1876370682.0000000000987000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.0000000000987000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1854190744.000000000097E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected CryptOne packer
Source: Yara match File source: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2420000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2420000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: kat6899.tmp PID: 6332, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: kat6899.tmp PID: 6332, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected CryptOne packer
Source: Yara match File source: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2420000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.5IRIk4f1PO.exe.2420000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: kat6899.tmp PID: 6332, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2015E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 1_2_2015E090
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2016E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_2016E170
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2015E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset, 1_2_2015E200
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201066C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 1_2_201066C0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2016A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value, 1_2_2016A6F0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2014EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code, 1_2_2014EF30
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2011B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64, 1_2_2011B400
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201B3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_201B3770
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201D37E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_201D37E0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20168200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset, 1_2_20168200
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20148550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset, 1_2_20148550
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20118680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64, 1_2_20118680
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201406E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, 1_2_201406E0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20104820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize, 1_2_20104820
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201D4D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 1_2_201D4D40
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20120FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 1_2_20120FB0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20189090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf, 1_2_20189090
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201951D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_201951D0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201AD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_201AD3B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2021D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log, 1_2_2021D4F0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_202114D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 1_2_202114D0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201955B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_201955B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_201CD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_201CD610
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20195910 sqlite3_mprintf,sqlite3_bind_int64, 1_2_20195910
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2021D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 1_2_2021D9E0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2016DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 1_2_2016DB10
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20105C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 1_2_20105C70
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_2016DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset, 1_2_2016DFC0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp Code function: 1_2_20171FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 1_2_20171FE0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1464556 Sample: 5IRIk4f1PO.exe Startdate: 29/06/2024 Architecture: WINDOWS Score: 100 20 t.me 2->20 22 windowsupdatebg.s.llnwi.net 2->22 28 Found malware configuration 2->28 30 Antivirus detection for URL or domain 2->30 32 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->32 34 7 other signatures 2->34 7 5IRIk4f1PO.exe 1 2->7         started        signatures3 process4 file5 16 C:\Users\user\AppData\Local\...\kat6899.tmp, PE32 7->16 dropped 36 Contains functionality to inject code into remote processes 7->36 38 Writes to foreign memory regions 7->38 40 Allocates memory in foreign processes 7->40 42 2 other signatures 7->42 11 kat6899.tmp 28 7->11         started        signatures6 process7 dnsIp8 24 t.me 149.154.167.99, 443, 49731 TELEGRAMRU United Kingdom 11->24 26 195.201.251.214, 49732, 49734, 49735 HETZNER-ASDE Germany 11->26 18 C:\Users\user\AppData\Local\...\sqlt[1].dll, PE32 11->18 dropped 44 Tries to harvest and steal browser information (history, passwords, etc) 11->44 file9 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
195.201.251.214
 unknown Germany
24940 HETZNER-ASDE false
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU true

Contacted Domains

Name IP Active
t.me 149.154.167.99 true
windowsupdatebg.s.llnwi.net 178.79.238.0 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://steamcommunity.com/profiles/76561199707802586 true
  • Avira URL Cloud: malware
 unknown
https://t.me/g067n true
  • Avira URL Cloud: malware
 unknown