Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1466008
MD5: 06333e350e25e29677256d9be86e4ee1
SHA1: 088fa1f912473c3dfb5ab118b0bc39ec016cf15a
SHA256: 137a7220fb3cbe605b6c74712ad96dcb1bdea1c489e9df159044500ccc23f3c8
Tags: exe
Infos:

Detection

PureLog Stealer, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected Vidar stealer
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://49.13.159.121:9000/vcruntime140.dlly Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/softokn3.dllg Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/sqlt.dllN Avira URL Cloud: Label: malware
Source: https://49.13.159.121/vFh Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/softokn3.dllt Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/vcruntime140.dllge Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/softokn3.dll Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/mozglue.dll10.15; Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/vcruntime140.dllX Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/mozglue.dllft Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000 Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/. Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/0 Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/freebl3.dll Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/vcruntime140.dllI Avira URL Cloud: Label: malware
Source: https://49.13.159.121/ Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/vcruntime140.dllE Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/freebl3.dllft Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/mozglue.dll Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/cal Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/B Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/nss3.dllB Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/F Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/D Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/nss3.dll Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/msvcp140.dll Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/X Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/softokn3.dllessionKeyBackward Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/mozglue.dllposition: Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/soft Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/nss3.dllosoft Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/softokn3.dllF Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199707802586 Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/ Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/i Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/sqlt.dlld Avira URL Cloud: Label: malware
Source: https://t.me/g067n Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/freebl3.dllv Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/msvcp140.dllt Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/vcruntime140.dll Avira URL Cloud: Label: malware
Source: https://49.13.159.121:9000/3e98icrosoft Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000000.00000002.2113529276.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "4e7fbe36a69903b4dfa6c1b767f4bf81"}
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 51%
Source: file.exe Virustotal: Detection: 54% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Sample uses string decryption to hide its real strings
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetProcAddress
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: LoadLibraryA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: lstrcatA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: OpenEventA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CreateEventA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CloseHandle
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Sleep
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: VirtualFree
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetSystemInfo
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: VirtualAlloc
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: HeapAlloc
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetComputerNameA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: lstrcpyA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetProcessHeap
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetCurrentProcess
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: lstrlenA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ExitProcess
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetSystemTime
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: advapi32.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: gdi32.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: user32.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: crypt32.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ntdll.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetUserNameA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CreateDCA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetDeviceCaps
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ReleaseDC
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sscanf
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: NtQueryInformationProcess
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: VMwareVMware
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: HAL9TH
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: JohnDoe
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: DISPLAY
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetFileAttributesA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GlobalLock
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: HeapFree
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetFileSize
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GlobalSize
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: IsWow64Process
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Process32Next
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetLocalTime
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: FreeLibrary
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Process32First
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: DeleteFileA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: FindNextFileA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: LocalFree
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: FindClose
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: LocalAlloc
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetFileSizeEx
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ReadFile
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SetFilePointer
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: WriteFile
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CreateFileA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: FindFirstFileA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CopyFileA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: VirtualProtect
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetLastError
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: lstrcpynA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GlobalFree
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GlobalAlloc
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: OpenProcess
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: TerminateProcess
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: gdiplus.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ole32.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: bcrypt.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: wininet.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: shlwapi.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: shell32.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: psapi.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SelectObject
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: BitBlt
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: DeleteObject
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdiplusStartup
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdiplusShutdown
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdipDisposeImage
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GdipFree
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CoUninitialize
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CoInitialize
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CoCreateInstance
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: BCryptDecrypt
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: BCryptSetProperty
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetWindowRect
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetDesktopWindow
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetDC
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CloseWindow
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: wsprintfA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CharToOemW
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: wsprintfW
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RegQueryValueExA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RegCloseKey
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RegEnumValueA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CryptUnprotectData
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ShellExecuteExA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: InternetConnectA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: InternetCloseHandle
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: InternetOpenA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: HttpSendRequestA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: InternetReadFile
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: StrCmpCA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: StrStrA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: StrCmpCW
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: PathMatchSpecA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RmStartSession
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RmRegisterResources
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RmGetList
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: RmEndSession
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_open
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_step
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_column_text
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_finalize
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_close
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: encrypted_key
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: PATH
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: NSS_Init
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: NSS_Shutdown
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: PK11_Authenticate
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: C:\ProgramData\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Soft:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: profile:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Host:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Login:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Password:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Opera
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: OperaGX
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Network
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Cookies
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: .txt
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: TRUE
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: FALSE
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Autofill
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: History
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Name:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Month:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Year:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Card:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Cookies
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Login Data
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Web Data
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: History
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: logins.json
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: formSubmitURL
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: usernameField
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: encryptedUsername
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: encryptedPassword
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: guid
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: cookies.sqlite
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: formhistory.sqlite
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: places.sqlite
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Plugins
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Local Extension Settings
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Sync Extension Settings
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: IndexedDB
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Opera Stable
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Opera GX Stable
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: CURRENT
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: chrome-extension_
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Local State
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: profiles.ini
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: chrome
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: opera
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: firefox
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Wallets
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ProductName
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ProcessorNameString
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: DisplayName
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: DisplayVersion
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: freebl3.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: mozglue.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: msvcp140.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: nss3.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: softokn3.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: vcruntime140.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \Temp\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: .exe
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: runas
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: open
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: /c start
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %DESKTOP%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %APPDATA%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %USERPROFILE%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: %RECENT%
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: *.lnk
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Files
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \discord\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: key_datas
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: map*
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Telegram
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: *.tox
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: *.ini
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Password
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: 00000001
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: 00000002
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: 00000003
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: 00000004
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Pidgin
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \.purple\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: accounts.xml
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: token:
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: SteamPath
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \config\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ssfn*
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: config.vdf
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: loginusers.vdf
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \Steam\
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: sqlite3.dll
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: browsers
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: done
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Soft
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: https
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: POST
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: HTTP/1.1
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: hwid
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: build
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: token
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: file_name
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: file
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: message
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.3f3bed8.7.raw.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00407E41 CryptUnprotectData,LocalAlloc,LocalFree, 4_2_00407E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041302D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 4_2_0041302D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00407DC2 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 4_2_00407DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040AB80 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA, 4_2_0040AB80
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49729 version: TLS 1.0
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: PE.pdbH] source: file.exe, 00000000.00000002.2114727387.0000000005490000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\CcYLxMOT.pdb source: file.exe, 00000000.00000002.2114887893.0000000005790000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: PE.pdb source: file.exe, 00000000.00000002.2114727387.0000000005490000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: newsoftgnu.pdb source: file.exe
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 4_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 4_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 4_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 4_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 4_2_0041738D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA, 4_2_004169EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 0_2_05ACD0C8

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor URLs: https://t.me/g067n
Yara detected Generic Downloader
Source: Yara match File source: file.exe, type: SAMPLE
Source: Yara match File source: 0.0.file.exe.670000.0.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49713 -> 49.13.159.121:9000
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49729 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: unknown TCP traffic detected without corresponding DNS query: 49.13.159.121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004058C4 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 4_2_004058C4
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: t.me
Source: file.exe String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: file.exe String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: MSBuild.exe, 00000004.00000002.3354509372.00000000015F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: file.exe String found in binary or memory: http://ocsp.sectigo.com0
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364794204.0000000022A2D000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121/
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121/vFh
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/
Source: MSBuild.exe, 00000004.00000002.3355032773.00000000016B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/.
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/0
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/3e98icrosoft
Source: MSBuild.exe, 00000004.00000002.3355084181.00000000016C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/B
Source: MSBuild.exe, 00000004.00000002.3355084181.00000000016C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/D
Source: MSBuild.exe, 00000004.00000002.3355032773.00000000016B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/F
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/X
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/cal
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000539000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3355084181.0000000001707000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/freebl3.dll
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/freebl3.dllft
Source: MSBuild.exe, 00000004.00000002.3355084181.0000000001707000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/freebl3.dllv
Source: MSBuild.exe, 00000004.00000002.3354509372.00000000015F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/i
Source: MSBuild.exe, 00000004.00000002.3355084181.0000000001707000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/mozglue.dll
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/mozglue.dll10.15;
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/mozglue.dllft
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/mozglue.dllposition:
Source: MSBuild.exe, 00000004.00000002.3355084181.0000000001707000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/msvcp140.dll
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/msvcp140.dllt
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/nss3.dll
Source: MSBuild.exe, 00000004.00000002.3355084181.00000000016C8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/nss3.dllB
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/nss3.dllosoft
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/soft
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/softokn3.dll
Source: MSBuild.exe, 00000004.00000002.3355084181.0000000001707000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/softokn3.dllF
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/softokn3.dllessionKeyBackward
Source: MSBuild.exe, 00000004.00000002.3355084181.0000000001707000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/softokn3.dllg
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/softokn3.dllt
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/sqlt.dllN
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/sqlt.dlld
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3355084181.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/vcruntime140.dll
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/vcruntime140.dllE
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/vcruntime140.dllI
Source: MSBuild.exe, 00000004.00000002.3354820037.000000000164C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/vcruntime140.dllX
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/vcruntime140.dllge
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000/vcruntime140.dlly
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000H--
Source: MSBuild.exe, 00000004.00000002.3352878258.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000d3e98icrosoft
Source: MSBuild.exe, 00000004.00000002.3352878258.00000000005C8000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000d3e98oogle
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000539000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000el
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000oaming
Source: MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://49.13.159.121:9000ocal
Source: AFCBKF.4.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AFCBKF.4.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AFCBKF.4.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AFCBKF.4.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AFCBKF.4.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AFCBKF.4.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AFCBKF.4.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-15916
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-159168
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-18203
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-18203.
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-20454
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-20454G
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-20455
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-20455N
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-21228
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-7046
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-7046Q
Source: file.exe String found in binary or memory: https://jira.adguard.com/browse/AG-7791
Source: file.exe String found in binary or memory: https://jira.int.agrd.dev/browse/AG-32263
Source: file.exe String found in binary or memory: https://jira.int.agrd.dev/browse/AG-32263-
Source: file.exe String found in binary or memory: https://sectigo.com/CPS0
Source: file.exe, 00000000.00000002.2113529276.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003F3B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003ED4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000004.00000002.3352878258.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: file.exe, 00000000.00000002.2113529276.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003F3B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003ED4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: MSBuild.exe, 00000004.00000002.3354509372.00000000015F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: file.exe, 00000000.00000002.2113529276.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003F3B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003ED4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000004.00000002.3352878258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3354509372.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3354757613.000000000162A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067n
Source: MSBuild.exe, 00000004.00000002.3354509372.00000000015B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067njT
Source: file.exe, 00000000.00000002.2113529276.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003F3B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2113529276.0000000003ED4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3352878258.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: MSBuild.exe, 00000004.00000002.3354757613.000000000162A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: AFCBKF.4.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: AFCBKF.4.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49712 version: TLS 1.2
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00413160 memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 4_2_00413160
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02C2F9C8 0_2_02C2F9C8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02C28B88 0_2_02C28B88
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02C28F80 0_2_02C28F80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_053965BB 0_2_053965BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0539B008 0_2_0539B008
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05397360 0_2_05397360
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_053943A8 0_2_053943A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05399AEB 0_2_05399AEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05398D40 0_2_05398D40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0539A9A8 0_2_0539A9A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0539A99B 0_2_0539A99B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05397F20 0_2_05397F20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0539734F 0_2_0539734F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0539439B 0_2_0539439B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0539AFF8 0_2_0539AFF8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_053B8998 0_2_053B8998
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_053B8A58 0_2_053B8A58
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_053B2A89 0_2_053B2A89
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05AC3036 0_2_05AC3036
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05AC1B10 0_2_05AC1B10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_053B2A98 0_2_053B2A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041ECEC 4_2_0041ECEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041E919 4_2_0041E919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041EEC1 4_2_0041EEC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041F6CF 4_2_0041F6CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227F4CF0 4_2_227F4CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E209F 4_2_227E209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2286A0B0 4_2_2286A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227F66C0 4_2_227F66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E47AF 4_2_227E47AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228DA590 4_2_228DA590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2280A560 4_2_2280A560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227EAA40 4_2_227EAA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227EEA80 4_2_227EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E481D 4_2_227E481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2291E800 4_2_2291E800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E3E3B 4_2_227E3E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228C69C0 4_2_228C69C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228FA900 4_2_228FA900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228DA940 4_2_228DA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22826E80 4_2_22826E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_229BAEBE 4_2_229BAEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22842EE0 4_2_22842EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E19DD 4_2_227E19DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22813370 4_2_22813370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227EF160 4_2_227EF160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E174E 4_2_227E174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2280BAB0 4_2_2280BAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22817810 4_2_22817810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E251D 4_2_227E251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E290A 4_2_227E290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E3AB2 4_2_227E3AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22860090 4_2_22860090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22908030 4_2_22908030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22868120 4_2_22868120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22808680 4_2_22808680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22808763 4_2_22808763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22844760 4_2_22844760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22878760 4_2_22878760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22920480 4_2_22920480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228E4A60 4_2_228E4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227EC800 4_2_227EC800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E1EF1 4_2_227E1EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2281CE10 4_2_2281CE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22808D2A 4_2_22808D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_229BD209 4_2_229BD209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E3580 4_2_227E3580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228753B0 4_2_228753B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227F9000 4_2_227F9000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22905040 4_2_22905040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22889690 4_2_22889690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2289D6D0 4_2_2289D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22949430 4_2_22949430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227ED4C0 4_2_227ED4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22909A20 4_2_22909A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E2018 4_2_227E2018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E1C9E 4_2_227E1C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22895940 4_2_22895940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E12A8 4_2_227E12A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E2AA9 4_2_227E2AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22949CC0 4_2_22949CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22811C50 4_2_22811C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E292D 4_2_227E292D
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 227E1C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 227E415B appears 173 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 229C06B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 00404239 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 227E395E appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 227E3AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: String function: 227E1F5A appears 36 times
PE / OLE file has an invalid certificate
Source: file.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2114887893.0000000005790000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCcYLxMOT.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2114727387.0000000005490000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamePE.dll& vs file.exe
Source: file.exe, 00000000.00000002.2112404610.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePE.dll& vs file.exe
Source: file.exe, 00000000.00000002.2112404610.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclrjit.dllT vs file.exe
Source: file.exe, 00000000.00000002.2112404610.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.2112404610.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs file.exe
Source: file.exe, 00000000.00000000.2106749742.0000000000B26000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamenewsoftgnu.exe$ vs file.exe
Source: file.exe, 00000000.00000002.2111827791.000000000114E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe Binary or memory string: OriginalFilenamenewsoftgnu.exe$ vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 0.2.file.exe.2e46048.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.2e46048.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.5790000.11.raw.unpack, KGoGDyk.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.file.exe.5490000.10.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.5490000.10.raw.unpack, fDX9tehJ5EFemhKZwc.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/12@1/2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041246A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 4_2_0041246A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004129BF CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear, 4_2_004129BF
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log Jump to behavior
Source: C:\Users\user\Desktop\file.exe Mutant created: NULL
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: GCBGII.4.dr, ECFCBK.4.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: file.exe ReversingLabs: Detection: 51%
Source: file.exe Virustotal: Detection: 54%
Source: file.exe String found in binary or memory: /stopService
Source: file.exe String found in binary or memory: /stopService
Source: file.exe String found in binary or memory: /reinstall
Source: file.exe String found in binary or memory: in-addr.arpa
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: file.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: file.exe Static file information: File size 4959240 > 1048576
Source: file.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x49f000
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: PE.pdbH] source: file.exe, 00000000.00000002.2114727387.0000000005490000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\CcYLxMOT.pdb source: file.exe, 00000000.00000002.2114887893.0000000005790000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: PE.pdb source: file.exe, 00000000.00000002.2114727387.0000000005490000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2112404610.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: newsoftgnu.pdb source: file.exe
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000004.00000002.3359533484.000000001CA84000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.3364573446.00000000229F8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.4.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.file.exe.2e46048.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.file.exe.5490000.10.raw.unpack, fDX9tehJ5EFemhKZwc.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041B050 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_0041B050
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00421EF5 push ecx; ret 4_2_00421F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E10C8 push ecx; ret 4_2_229E3552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E1BF9 push ecx; ret 4_2_22984C03
Source: 0.2.file.exe.2e46048.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.file.exe.2e46048.1.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Source: 0.2.file.exe.5490000.10.raw.unpack, fDX9tehJ5EFemhKZwc.cs High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 0.2.file.exe.5490000.10.raw.unpack, zcrmeG4DKc05Qj8A7l.cs High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlt[1].dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041B050 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_0041B050
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: file.exe PID: 1804, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: 2C20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 2DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 4DF0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlt[1].dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 4992 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose, 4_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 4_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 4_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 4_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 4_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 4_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 4_2_0041738D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA, 4_2_004169EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00411F21 GetSystemInfo,wsprintfA, 4_2_00411F21
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: AAEHDA.4.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: AAEHDA.4.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: AAEHDA.4.dr Binary or memory string: discord.comVMware20,11696487552f
Source: AAEHDA.4.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: AAEHDA.4.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: MSBuild.exe, 00000004.00000002.3354509372.0000000001616000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: AAEHDA.4.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: global block list test formVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: MSBuild.exe, 00000004.00000002.3354509372.0000000001616000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW^
Source: AAEHDA.4.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: AAEHDA.4.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: AAEHDA.4.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: AAEHDA.4.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe Binary or memory string: JUxvupfc339huwQeMul
Source: AAEHDA.4.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: MSBuild.exe, 00000004.00000002.3354509372.00000000015B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: file.exe Binary or memory string: carmO8a0VBurhRuvmcIN
Source: AAEHDA.4.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: AAEHDA.4.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: AAEHDA.4.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: AAEHDA.4.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: MSBuild.exe, 00000004.00000002.3354509372.00000000015B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: AAEHDA.4.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: AAEHDA.4.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: AAEHDA.4.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: AAEHDA.4.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: AAEHDA.4.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: AAEHDA.4.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: AAEHDA.4.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: AAEHDA.4.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00421C0B
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041B050 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_0041B050
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0041ACF3 mov eax, dword ptr fs:[00000030h] 4_2_0041ACF3
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004058C4 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 4_2_004058C4
Enables debug privileges
Source: C:\Users\user\Desktop\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_00421C0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00423DCD SetUnhandledExceptionFilter, 4_2_00423DCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_0042224F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0042224F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E42AF SetUnhandledExceptionFilter, 4_2_227E42AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227E2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_227E2C8E
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 1804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6312, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\file.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00410A14 memset,memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread, 4_2_00410A14
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Searches for specific processes (likely to inject)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004138BA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification, 4_2_004138BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_004137BD CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 4_2_004137BD
Writes to foreign memory regions
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 425000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42E000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 643000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 11CB008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00401000 cpuid 4_2_00401000
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 4_2_00411D31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 4_2_227E298C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: EnumSystemLocalesW, 4_2_229BFF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetLocaleInfoW, 4_2_227E2112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: GetLocaleInfoW, 4_2_227E2112
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00411C63 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA, 4_2_00411C63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00411BEC GetProcessHeap,HeapAlloc,GetUserNameA, 4_2_00411BEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_00411CBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 4_2_00411CBF
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: MSBuild.exe, 00000004.00000002.3355565324.0000000001803000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected PureLog Stealer
Source: Yara match File source: file.exe, type: SAMPLE
Source: Yara match File source: 0.0.file.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.2106139036.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 0.2.file.exe.3f3bed8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ed4a88.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3f6f908.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ed4a88.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3f6f908.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3f3bed8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.3352878258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2112404610.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003F3B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003ED4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 1804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6312, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6312, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected PureLog Stealer
Source: Yara match File source: file.exe, type: SAMPLE
Source: Yara match File source: 0.0.file.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.2106139036.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 0.2.file.exe.3f3bed8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ed4a88.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3f6f908.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3ed4a88.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3f6f908.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3f3bed8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.3352878258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2112404610.0000000002F4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003F3B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2113529276.0000000003ED4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.3352878258.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 1804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 6312, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2284E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset, 4_2_2284E200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2284E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 4_2_2284E090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2285E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_2285E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2285A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value, 4_2_2285A6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227F66C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 4_2_227F66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2283EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code, 4_2_2283EF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228C37E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_228C37E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228A3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_228A3770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2280B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64, 4_2_2280B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22817810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, 4_2_22817810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22858200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset, 4_2_22858200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228C4140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, 4_2_228C4140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22808680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64, 4_2_22808680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228306E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, 4_2_228306E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22818430 sqlite3_bind_int64, 4_2_22818430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22838550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset, 4_2_22838550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227F4820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize, 4_2_227F4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22818970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 4_2_22818970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22810FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 4_2_22810FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22818CB0 sqlite3_bind_zeroblob, 4_2_22818CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228C4D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 4_2_228C4D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2289D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_2289D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22879090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf, 4_2_22879090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228851D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_228851D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228BD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_228BD610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_229014D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 4_2_229014D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2290D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log, 4_2_2290D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_228855B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_228855B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2285DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, 4_2_2285DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2290D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, 4_2_2290D9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22885910 sqlite3_mprintf,sqlite3_bind_int64, 4_2_22885910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_2285DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset, 4_2_2285DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_22861FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, 4_2_22861FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 4_2_227F5C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, 4_2_227F5C70
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1466008 Sample: file.exe Startdate: 02/07/2024 Architecture: WINDOWS Score: 100 24 t.me 2->24 26 windowsupdatebg.s.llnwi.net 2->26 28 3 other IPs or domains 2->28 34 Found malware configuration 2->34 36 Antivirus detection for URL or domain 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 10 other signatures 2->40 7 file.exe 3 2->7         started        signatures3 process4 file5 20 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 7->20 dropped 42 Writes to foreign memory regions 7->42 44 Allocates memory in foreign processes 7->44 46 Injects a PE file into a foreign processes 7->46 11 MSBuild.exe 7->11         started        14 MSBuild.exe 29 7->14         started        18 MSBuild.exe 7->18         started        signatures6 process7 dnsIp8 48 Contains functionality to inject code into remote processes 11->48 50 Searches for specific processes (likely to inject) 11->50 30 t.me 149.154.167.99, 443, 49712 TELEGRAMRU United Kingdom 14->30 32 49.13.159.121, 49713, 49716, 49717 HETZNER-ASDE Germany 14->32 22 C:\Users\user\AppData\Local\...\sqlt[1].dll, PE32 14->22 dropped 52 Tries to harvest and steal browser information (history, passwords, etc) 14->52 file9 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
49.13.159.121
 unknown Germany
24940 HETZNER-ASDE false
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU true

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
t.me 149.154.167.99 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
windowsupdatebg.s.llnwi.net 41.63.96.128 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://steamcommunity.com/profiles/76561199707802586 true
  • Avira URL Cloud: malware
 unknown
https://t.me/g067n true
  • Avira URL Cloud: malware
 unknown