Windows Analysis Report
M9dfZzH3qn.exe

Overview

General Information

Sample name:	M9dfZzH3qn.exe renamed because original name is a hash value
Original sample name:	dee45b3ad0c841d54049061df5775ec0.exe
Analysis ID:	1464560
MD5:	dee45b3ad0c841d54049061df5775ec0
SHA1:	6fcbcf0d362d83ac346576ec8ba66b0cb3f1b4fd
SHA256:	159e547225b9f035bf95279055d66810149fa93debea660766552008271e3e5c
Tags:	32exe
Infos:

Detection

CryptOne, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Yara detected CryptOne packer

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

Multi AV Scanner detection for submitted file

Source: M9dfZzH3qn.exe	Virustotal: Detection: 35%			Perma Link
Source: M9dfZzH3qn.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: M9dfZzH3qn.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Sleep
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sscanf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NtQueryInformationProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Process32First
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindClose
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PATH
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Soft:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: profile:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Host:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Login:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Password:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Network
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: .txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: TRUE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FALSE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Autofill
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: History
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Name:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Month:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Year:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Card:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Login Data
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Web Data
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: History
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: logins.json
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: usernameField
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: guid
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Plugins
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Local State
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: chrome
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: opera
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: firefox
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Wallets
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ProductName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: .exe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: runas
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: open
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: /c start
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Files
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \discord\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: key_datas
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: map*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Telegram
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.tox
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.ini
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Password
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000001
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000002
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000003
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000004
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: token:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \config\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: browsers
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: done
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Soft
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: https
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: POST
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: hwid
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: build
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: token
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: file_name
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: file
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: message
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: screenshot.jpg

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Unpacked PE file: 1.2.kat99F5.tmp.22620000.0.unpack

Uses 32bit PE files

Source: M9dfZzH3qn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49247 version: TLS 1.2

Source:

Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49248 -> 195.201.251.214:9000

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: kat99F5.tmp, 00000001.00000003.1708011594.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: kat99F5.tmp, 00000001.00000003.1884389408.0000000000967000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000968000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: kat99F5.tmp, 00000001.00000003.1708011594.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3858708399b65
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000958000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1884389408.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabz
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000000.1651485308.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, kat99F5.tmp.0.dr	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: M9dfZzH3qn.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types7
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesJ
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53E
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53F
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-cF
Source: kat99F5.tmp, 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/?
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/_
Source: kat99F5.tmp, 00000001.00000003.1689316500.000000000092E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000
Source: kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824196823.00000000009DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/
Source: kat99F5.tmp, 00000001.00000003.1884389408.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867996216.0000000000973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/%
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/9
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/?
Source: kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Mac
Source: kat99F5.tmp, 00000001.00000003.1884389408.000000000095F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.0000000000961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/P
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/a
Source: kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/al
Source: kat99F5.tmp, 00000001.00000003.1847246580.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/d
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllD
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllF
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllU
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllla
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/j
Source: kat99F5.tmp, 00000001.00000002.2891747383.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/lV
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll)b
Source: kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllM
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll-
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll15;
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllf
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllr
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/o
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/rlM
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllb
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: kat99F5.tmp, 00000001.00000003.2779015830.0000000000931000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891747383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/w
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Google
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000f4cle
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000g
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000t.txtoft
Source: IDBAFH.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IDBAFH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000931000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1689316500.000000000092E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n2r
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: kat99F5.tmp, 00000001.00000003.1689316500.0000000000957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: IDBAFH.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IDBAFH.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49247 version: TLS 1.2

Yara detected Keylogger Generic

Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR

Contains functionality to call native functions

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5B510 NtProtectVirtualMemory,NtProtectVirtualMemory,	0_2_02B5B510
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5BEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02B5BEF0
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5B250 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification,	0_2_02B5B250

Detected potential crypto function

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5C510	0_2_02B5C510
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22634CF0	1_2_22634CF0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226AA0B0	1_2_226AA0B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262209F	1_2_2262209F
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226366C0	1_2_226366C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226247AF	1_2_226247AF
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264A560	1_2_2264A560
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2271A590	1_2_2271A590
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262AA40	1_2_2262AA40
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262EA80	1_2_2262EA80
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2275E800	1_2_2275E800
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262481D	1_2_2262481D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623E3B	1_2_22623E3B
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2271A940	1_2_2271A940
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2273A900	1_2_2273A900
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227069C0	1_2_227069C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22682EE0	1_2_22682EE0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227FAEBE	1_2_227FAEBE
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22666E80	1_2_22666E80
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226219DD	1_2_226219DD
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22653370	1_2_22653370
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262F160	1_2_2262F160
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262174E	1_2_2262174E
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264BAB0	1_2_2264BAB0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262251D	1_2_2262251D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262290A	1_2_2262290A
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623AB2	1_2_22623AB2
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22748030	1_2_22748030
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A0090	1_2_226A0090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A8120	1_2_226A8120
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648680	1_2_22648680
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648763	1_2_22648763
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22684760	1_2_22684760
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B8760	1_2_226B8760
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22760480	1_2_22760480
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22724A60	1_2_22724A60
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621EF1	1_2_22621EF1
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648D2A	1_2_22648D2A
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227FD209	1_2_227FD209
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623580	1_2_22623580
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B53B0	1_2_226B53B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22745040	1_2_22745040
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22639000	1_2_22639000
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226DD6D0	1_2_226DD6D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C9690	1_2_226C9690
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22789430	1_2_22789430
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22749A20	1_2_22749A20
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622018	1_2_22622018
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621C9E	1_2_22621C9E
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226D5940	1_2_226D5940
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622AA9	1_2_22622AA9
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226212A8	1_2_226212A8
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262292D	1_2_2262292D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22789CC0	1_2_22789CC0

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\kat99F5.tmp 6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22621C2B appears 47 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 2262415B appears 133 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 2262395E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22623AF3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22621F5A appears 31 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 228006B1 appears 36 times

Sample file is different than original file name gathered from version info

Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameResHack! vs M9dfZzH3qn.exe

Uses 32bit PE files

Source: M9dfZzH3qn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@1/2

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\EGRMTY3W.htm

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

File created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: DGHIDA.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: M9dfZzH3qn.exe	Virustotal: Detection: 35%
Source: M9dfZzH3qn.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\M9dfZzH3qn.exe "C:\Users\user\Desktop\M9dfZzH3qn.exe"
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: M9dfZzH3qn.exe

Static file information: File size 2288128 > 1048576

Source: M9dfZzH3qn.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x127800

Source:

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Unpacked PE file: 1.2.kat99F5.tmp.22620000.0.unpack

PE file contains sections with non-standard names

Source: sqlt[1].dll.1.dr

Static PE information: section name: .00cfg

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5CA10 push edx; ret	0_2_02B5CC1F
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5C310 push edx; ret	0_2_02B5C31B
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226210C8 push ecx; ret	1_2_22823552
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621BF9 push ecx; ret	1_2_227C4C03

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	File created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon.png

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000921000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpB
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWGj

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_22622C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_22622C8E

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_226246A6 GetProcessHeap,

1_2_226246A6

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226242AF SetUnhandledExceptionFilter,		1_2_226242AF
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_22622C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Code function: 0_2_02B5BEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02B5BEF0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 643000	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Jump to behavior

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812CB6
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812DF9
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812D38
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_22813300
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_22623AA3
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_227FFF17
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,	1_2_22622112
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,	1_2_22622112

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_2262433C GetSystemTimeAsFileTime,

1_2_2262433C

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_22804A46 GetTimeZoneInformation,

1_2_22804A46

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: kat99F5.tmp, 00000001.00000003.1822336993.00000000009EF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2268E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	1_2_2268E200
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2268E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_2268E090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_2269E170
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	1_2_2269A6F0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226366C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_226366C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2267EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	1_2_2267EF30
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226E3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226E3770
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227037E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_227037E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	1_2_2264B400
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22698200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	1_2_22698200
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226706E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	1_2_226706E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	1_2_22648680
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22678550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	1_2_22678550
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22634820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	1_2_22634820
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22650FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_22650FB0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22704D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_22704D40
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226DD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226DD3B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	1_2_226B9090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226C51D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226FD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226FD610
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2274D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2274D4F0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227414D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_227414D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226C55B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_2269DB10
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C5910 sqlite3_mprintf,sqlite3_bind_int64,	1_2_226C5910
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2274D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2274D9E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A1FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226A1FE0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	1_2_2269DFC0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22635C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_22635C70

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.201.251.214	unknown	Germany		24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	true

Contacted Domains

Name	IP	Active
t.me	149.154.167.99	true
windowsupdatebg.s.llnwi.net	87.248.205.0	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199707802586	true	Avira URL Cloud: malware	unknown
https://t.me/g067n	true	Avira URL Cloud: malware	unknown

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

Multi AV Scanner detection for submitted file

Source: M9dfZzH3qn.exe	Virustotal: Detection: 35%			Perma Link
Source: M9dfZzH3qn.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: M9dfZzH3qn.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Sleep
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sscanf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NtQueryInformationProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Process32First
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindClose
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PATH
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Soft:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: profile:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Host:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Login:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Password:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Network
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: .txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: TRUE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FALSE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Autofill
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: History
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Name:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Month:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Year:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Card:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Login Data
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Web Data
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: History
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: logins.json
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: usernameField
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: guid
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Plugins
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Local State
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: chrome
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: opera
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: firefox
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Wallets
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ProductName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: .exe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: runas
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: open
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: /c start
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Files
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \discord\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: key_datas
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: map*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Telegram
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.tox
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.ini
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Password
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000001
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000002
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000003
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000004
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: token:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \config\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: browsers
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: done
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Soft
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: https
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: POST
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: hwid
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: build
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: token
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: file_name
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: file
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: message
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: screenshot.jpg

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Unpacked PE file: 1.2.kat99F5.tmp.22620000.0.unpack

Uses 32bit PE files

Source: M9dfZzH3qn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49247 version: TLS 1.2

Source:

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49248 -> 195.201.251.214:9000

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: kat99F5.tmp, 00000001.00000003.1708011594.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: kat99F5.tmp, 00000001.00000003.1884389408.0000000000967000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000968000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: kat99F5.tmp, 00000001.00000003.1708011594.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3858708399b65
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000958000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1884389408.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabz
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000000.1651485308.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, kat99F5.tmp.0.dr	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: M9dfZzH3qn.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types7
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesJ
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53E
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53F
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-cF
Source: kat99F5.tmp, 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/?
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/_
Source: kat99F5.tmp, 00000001.00000003.1689316500.000000000092E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000
Source: kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824196823.00000000009DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/
Source: kat99F5.tmp, 00000001.00000003.1884389408.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867996216.0000000000973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/%
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/9
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/?
Source: kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Mac
Source: kat99F5.tmp, 00000001.00000003.1884389408.000000000095F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.0000000000961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/P
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/a
Source: kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/al
Source: kat99F5.tmp, 00000001.00000003.1847246580.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/d
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllD
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllF
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllU
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllla
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/j
Source: kat99F5.tmp, 00000001.00000002.2891747383.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/lV
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll)b
Source: kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllM
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll-
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll15;
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllf
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllr
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/o
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/rlM
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllb
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: kat99F5.tmp, 00000001.00000003.2779015830.0000000000931000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891747383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/w
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Google
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000f4cle
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000g
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000t.txtoft
Source: IDBAFH.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IDBAFH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000931000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1689316500.000000000092E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n2r
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: kat99F5.tmp, 00000001.00000003.1689316500.0000000000957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: IDBAFH.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IDBAFH.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49247 version: TLS 1.2

Yara detected Keylogger Generic

Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR

Contains functionality to call native functions

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5B510 NtProtectVirtualMemory,NtProtectVirtualMemory,	0_2_02B5B510
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5BEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02B5BEF0
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5B250 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification,	0_2_02B5B250

Detected potential crypto function

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5C510	0_2_02B5C510
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22634CF0	1_2_22634CF0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226AA0B0	1_2_226AA0B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262209F	1_2_2262209F
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226366C0	1_2_226366C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226247AF	1_2_226247AF
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264A560	1_2_2264A560
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2271A590	1_2_2271A590
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262AA40	1_2_2262AA40
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262EA80	1_2_2262EA80
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2275E800	1_2_2275E800
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262481D	1_2_2262481D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623E3B	1_2_22623E3B
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2271A940	1_2_2271A940
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2273A900	1_2_2273A900
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227069C0	1_2_227069C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22682EE0	1_2_22682EE0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227FAEBE	1_2_227FAEBE
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22666E80	1_2_22666E80
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226219DD	1_2_226219DD
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22653370	1_2_22653370
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262F160	1_2_2262F160
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262174E	1_2_2262174E
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264BAB0	1_2_2264BAB0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262251D	1_2_2262251D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262290A	1_2_2262290A
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623AB2	1_2_22623AB2
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22748030	1_2_22748030
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A0090	1_2_226A0090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A8120	1_2_226A8120
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648680	1_2_22648680
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648763	1_2_22648763
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22684760	1_2_22684760
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B8760	1_2_226B8760
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22760480	1_2_22760480
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22724A60	1_2_22724A60
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621EF1	1_2_22621EF1
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648D2A	1_2_22648D2A
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227FD209	1_2_227FD209
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623580	1_2_22623580
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B53B0	1_2_226B53B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22745040	1_2_22745040
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22639000	1_2_22639000
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226DD6D0	1_2_226DD6D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C9690	1_2_226C9690
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22789430	1_2_22789430
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22749A20	1_2_22749A20
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622018	1_2_22622018
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621C9E	1_2_22621C9E
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226D5940	1_2_226D5940
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622AA9	1_2_22622AA9
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226212A8	1_2_226212A8
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262292D	1_2_2262292D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22789CC0	1_2_22789CC0

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\kat99F5.tmp 6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22621C2B appears 47 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 2262415B appears 133 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 2262395E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22623AF3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22621F5A appears 31 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 228006B1 appears 36 times

Sample file is different than original file name gathered from version info

Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameResHack! vs M9dfZzH3qn.exe

Uses 32bit PE files

Source: M9dfZzH3qn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@1/2

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\EGRMTY3W.htm

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

File created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: DGHIDA.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: M9dfZzH3qn.exe	Virustotal: Detection: 35%
Source: M9dfZzH3qn.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\M9dfZzH3qn.exe "C:\Users\user\Desktop\M9dfZzH3qn.exe"
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: M9dfZzH3qn.exe

Static file information: File size 2288128 > 1048576

Source: M9dfZzH3qn.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x127800

Source:

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Unpacked PE file: 1.2.kat99F5.tmp.22620000.0.unpack

PE file contains sections with non-standard names

Source: sqlt[1].dll.1.dr

Static PE information: section name: .00cfg

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5CA10 push edx; ret	0_2_02B5CC1F
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5C310 push edx; ret	0_2_02B5C31B
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226210C8 push ecx; ret	1_2_22823552
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621BF9 push ecx; ret	1_2_227C4C03

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	File created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon.png

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000921000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpB
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWGj

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_22622C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_22622C8E

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_226246A6 GetProcessHeap,

1_2_226246A6

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226242AF SetUnhandledExceptionFilter,		1_2_226242AF
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_22622C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

0_2_02B5BEF0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 643000	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Jump to behavior

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812CB6
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812DF9
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812D38
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_22813300
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_22623AA3
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_227FFF17
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,	1_2_22622112
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,	1_2_22622112

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_2262433C GetSystemTimeAsFileTime,

1_2_2262433C

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_22804A46 GetTimeZoneInformation,

1_2_22804A46

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: kat99F5.tmp, 00000001.00000003.1822336993.00000000009EF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2268E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	1_2_2268E200
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2268E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_2268E090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_2269E170
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	1_2_2269A6F0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226366C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_226366C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2267EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	1_2_2267EF30
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226E3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226E3770
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227037E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_227037E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	1_2_2264B400
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22698200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	1_2_22698200
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226706E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	1_2_226706E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	1_2_22648680
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22678550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	1_2_22678550
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22634820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	1_2_22634820
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22650FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_22650FB0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22704D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_22704D40
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226DD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226DD3B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	1_2_226B9090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226C51D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226FD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226FD610
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2274D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2274D4F0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227414D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_227414D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226C55B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_2269DB10
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C5910 sqlite3_mprintf,sqlite3_bind_int64,	1_2_226C5910
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2274D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2274D9E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A1FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226A1FE0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	1_2_2269DFC0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22635C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_22635C70

ID:	1464560
Product:	CloudBasic
Start time:	02:29:05
Start date:	29.06.2024
Sample:	M9dfZzH3qn.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	dee45b3ad0c841d54049061df5775ec0
SHA1:	6fcbcf0d362d83ac346576ec8ba66b0cb3f1b4fd
SHA256:	159e547225b9f035bf95279055d66810149fa93debea660766552008271e3e5c
Filetype:	Win32 Executable (generic) a (10002005/4) 93.58%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\KEBKJDBAAKJD\CBFCBK	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2	780853CDDEAEE8DE70F28A4B255A600B	AD7A5DA33F7AD12946153C497E990720B09005ED	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
C:\ProgramData\KEBKJDBAAKJD\DBFBFB	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4	6A6BAD38068B0F6F2CADC6464C4FE8F0	4E3B235898D8E900548613DDB6EA59CDA5EB4E68	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
C:\ProgramData\KEBKJDBAAKJD\DGHIDA	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1	28222628A3465C5F0D4B28F70F97F482	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
C:\ProgramData\KEBKJDBAAKJD\DGHJEH	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11	41EA9A4112F057AE6BA17E2838AEAC26	F2B389103BFD1A1A050C4857A995B09FEAFE8903	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
C:\ProgramData\KEBKJDBAAKJD\GIIIIJ	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1	349E6EB110E34A08924D92F6B334801D	BDFB289DAFF51890CC71697B6322AA4B35EC9169	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
C:\ProgramData\KEBKJDBAAKJD\IDBAFH	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3	28591AA4E12D1C4FC761BE7C0A468622	BC4968A84C19377D05A8BB3F208FBFAC49F4820B	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
C:\ProgramData\KEBKJDBAAKJD\KEBKJD	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2	A2D1F4CF66465F9F0CAC61C4A95C7EDE	BA6A845E247B221AAEC96C4213E1FD3744B10A27	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	358E8793A8CF27CEAE3047403B645D5D	B09FBF18A27DAB7FBE820B06BDEE30C346258895	033E2110B2D00077153ADFA402B0677238987747DFBFDAC97B92EBBE50524AB0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	90E744829865D57082A7F452EDC90DE5	833B178775F39675FA4E55EAB1032353514E1052	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
C:\Users\user\AppData\Local\Temp\kat99F5.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	66064DBDB70A5EB15EBF3BF65ABA254B	0284FD320F99F62ACA800FB1251EFF4C31EC4ED7	6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795

Windows Analysis Report
M9dfZzH3qn.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report M9dfZzH3qn.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
M9dfZzH3qn.exe

Malware Threat Intel
Provided by