Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.30060.94.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Analysis ID: 1470314
MD5: 79deee81f5bbea4e423490a1b122c90c
SHA1: 49f5b097f733601d67583919c9b4563fab26599d
SHA256: 166ec6d652868c9e7760976dc2458655ca15c6da2b2dcc767820b079da76fe81
Tags: exe
Infos:

Detection

Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to infect the boot sector
Contains functionality to register a low level keyboard hook
Machine Learning detection for dropped file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Abnormal high CPU Usage
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Avira: detected
Antivirus detection for dropped file
Source: C:\ProgramData\loantmp\1.0.1.205\exten.dll Avira: detection malicious, Label: ADWARE/Qjwmonkey.wsjlh
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Avira: detection malicious, Label: ADWARE/Bang5Mai.smnnh
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe ReversingLabs: Detection: 36%
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe ReversingLabs: Detection: 50%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 94.8% probability
Machine Learning detection for dropped file
Source: C:\ProgramData\loantmp\1.0.1.205\exten.dll Joe Sandbox ML: detected
Source: C:\ProgramData\loantmp\1.0.1.205\loanNPHelper.dll Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\resource\License.txt Jump to behavior
Source: Binary string: D:\develop\LoanCalc\project\bin\Release\LoanCal.pdb source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266221491.0000000003630000.00000004.00001000.00020000.00000000.sdmp, LoanCal.exe.0.dr
Source: Binary string: D:\develop\LoanCalc\project\bin\Release\LoanCal.pdbp9V` source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266221491.0000000003630000.00000004.00001000.00020000.00000000.sdmp, LoanCal.exe.0.dr
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040372C GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime, 0_2_0040372C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00403211 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z, 0_2_00403211
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00817D60 FindFirstFileW,FindClose,FindClose, 5_2_00817D60
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007FAEF0 FindFirstFileW,_memmove,FindNextFileW,FindClose, 5_2_007FAEF0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00817AE0 FindFirstFileW,FindNextFileW,FindClose, 5_2_00817AE0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007FBCD0 _memset,OleInitialize,SHBrowseForFolderW,OleUninitialize,SHGetPathFromIDListW,FindFirstFileW,FindClose,MessageBoxW,OleUninitialize,OleUninitialize, 5_2_007FBCD0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00817F20 FindFirstFileW,FindClose,FindClose, 5_2_00817F20
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002C19000.00000004.00000020.00020000.00000000.sdmp, exten.dll.0.dr String found in binary or memory: http:///client.do/?method=configex&extpackage=%dLocal
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, LCAssist.exe.0.dr String found in binary or memory: http://activewy2/client.do/?method=testtest1__ldluLdLu%pEe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1262153010.00000000027F3000.00000004.00000020.00020000.00000000.sdmp, fileConfig.xml.0.dr String found in binary or memory: http://www.1gongju.com/loan/
Source: LCInstall.exe, 00000005.00000002.3733199929.0000000002530000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.1gongju.com/loan/ddr2
Source: LCInstall.exe, 00000005.00000002.3733199929.0000000002530000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.1gongju.com/loan/in
Source: LCInstall.exe, 00000005.00000002.3733060299.0000000002420000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jyrili.com/client.do/?method=configex&extpackage=103

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00408DA3 SetWindowsHookExW 00000002,Function_00008D75,00000000,00000000 0_2_00408DA3
Abnormal high CPU Usage
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process Stats: CPU usage > 49%
Contains functionality to communicate with device drivers
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0081BD50: CreateFileW,DeviceIoControl,FindCloseChangeNotification, 5_2_0081BD50
Contains functionality to delete services
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007FB2C0 OpenSCManagerW,CloseServiceHandle,CloseServiceHandle,DeleteService,CloseServiceHandle, 5_2_007FB2C0
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00405C18 0_2_00405C18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040B0D0 0_2_0040B0D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040B0D4 0_2_0040B0D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040A8F0 0_2_0040A8F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00419943 0_2_00419943
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040A260 0_2_0040A260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040D470 0_2_0040D470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040AC10 0_2_0040AC10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00409C10 0_2_00409C10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040ED00 0_2_0040ED00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00409DC0 0_2_00409DC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_004195D1 0_2_004195D1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_004196AB 0_2_004196AB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00418F10 0_2_00418F10
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0080A6F0 5_2_0080A6F0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0080CBF0 5_2_0080CBF0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00801C40 5_2_00801C40
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00840073 5_2_00840073
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007F63A0 5_2_007F63A0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_008064C0 5_2_008064C0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0084045B 5_2_0084045B
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_008006B0 5_2_008006B0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00844613 5_2_00844613
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007EE740 5_2_007EE740
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00812870 5_2_00812870
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007EE9F0 5_2_007EE9F0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00806960 5_2_00806960
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00804A70 5_2_00804A70
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00842D46 5_2_00842D46
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083AEA8 5_2_0083AEA8
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0082CE2A 5_2_0082CE2A
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083D026 5_2_0083D026
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00843297 5_2_00843297
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007FB330 5_2_007FB330
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0084B350 5_2_0084B350
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083F46E 5_2_0083F46E
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007F96B0 5_2_007F96B0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007E56A0 5_2_007E56A0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_008437E8 5_2_008437E8
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083F903 5_2_0083F903
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0082BA00 5_2_0082BA00
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083FCA1 5_2_0083FCA1
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083BF03 5_2_0083BF03
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007FFFD0 5_2_007FFFD0
Found potential string decryption / allocating functions
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: String function: 0082E680 appears 60 times
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: String function: 0082A6BC appears 45 times
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: String function: 008296B7 appears 61 times
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: String function: 00832E10 appears 55 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: String function: 004029DB appears 44 times
PE file contains executable resources (Code or Archives)
Source: LCInstall.exe.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002DC5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUninst.exeB vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002F7B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLoanCal.exe8 vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266221491.00000000036BC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamecalcservice.exe@ vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266221491.00000000036BC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebAssist.dll8 vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002DBB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameinstall.exe8 vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002C9E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvassist.exe< vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1260594465.00000000024E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameInstall.exeD" vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamecalcservice.exe@ vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002FA5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebAssist.dll8 vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000000.1258290453.0000000000433000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameInstall.exeD" vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1260528236.00000000024E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameInstall.exeD" vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002C19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266099806.00000000007E0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebAssist.dll8 vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266221491.0000000003692000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLoanCal.exe8 vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1260768494.00000000024E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameInstall.exeD" vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Binary or memory string: OriginalFilenameInstall.exeD" vs SecuriteInfo.com.Win32.Evo-gen.30060.94.exe
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal96.spyw.evad.winEXE@3/43@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_004095EE wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree, 0_2_004095EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040122A GetDiskFreeSpaceExW,SendMessageW, 0_2_0040122A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_004092A9 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow, 0_2_004092A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_004020D2 GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress, 0_2_004020D2
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Mutant created: NULL
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Command line argument: 7142 5_2_00801C40
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Command line argument: 6.0.1.1 5_2_00801C40
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Command line argument: www.jyrili.com 5_2_00801C40
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Command line argument: source.ini 5_2_00801C40
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Command line argument: 6.0.1.1 5_2_00801C40
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Command line argument: 7142 5_2_00801C40
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Command line argument: loancal 5_2_00801C40
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,Name,ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Process created: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe "C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe" /I
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Process created: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe "C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe" /I Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: propsys.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: amsi.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Static file information: File size 1342212 > 1048576
Source: Binary string: D:\develop\LoanCalc\project\bin\Release\LoanCal.pdb source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266221491.0000000003630000.00000004.00001000.00020000.00000000.sdmp, LoanCal.exe.0.dr
Source: Binary string: D:\develop\LoanCalc\project\bin\Release\LoanCal.pdbp9V` source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1265655392.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.30060.94.exe, 00000000.00000003.1266221491.0000000003630000.00000004.00001000.00020000.00000000.sdmp, LoanCal.exe.0.dr
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00402678 LoadLibraryA,GetProcAddress,GetNativeSystemInfo, 0_2_00402678
PE file contains an invalid checksum
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Static PE information: real checksum: 0x37191 should be: 0x155431
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00419290 push eax; ret 0_2_004192BE
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_008300F9 push ecx; ret 5_2_0083010C
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00832E55 push ecx; ret 5_2_00832E68

Persistence and Installation Behavior
barindex
Contains functionality to infect the boot sector
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle,_free, \\.\PhysicalDrive%d 5_2_00823A50
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: CreateFileA,_memset,DeviceIoControl,_strcpy_s,_strcpy_s,_memset,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%d 5_2_00823F40
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LCAssist.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\loanNPHelper.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\exten.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LoanCal.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\fixfunction.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\loancalservice.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LCUninst.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LCAssist.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\loanNPHelper.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\exten.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LoanCal.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\fixfunction.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\loancalservice.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\LCUninst.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe File created: C:\ProgramData\loantmp\1.0.1.205\resource\License.txt Jump to behavior

Boot Survival
barindex
Contains functionality to infect the boot sector
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle,_free, \\.\PhysicalDrive%d 5_2_00823A50
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: CreateFileA,_memset,DeviceIoControl,_strcpy_s,_strcpy_s,_memset,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%d 5_2_00823F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE (SerialNumber IS NOT NULL) AND (MediaType LIKE &apos;Fixed hard disk%&apos;)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT PNPDeviceID FROM Win32_NetworkAdapter WHERE (MACAddress IS NOT NULL) AND (NOT (PNPDeviceID LIKE &apos;ROOT%&apos;))
Contains functionality to query network adapater information
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: _memset,GetAdaptersInfo, 5_2_00824760
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Window / User API: threadDelayed 7386 Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Window / User API: threadDelayed 2539 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Dropped PE file which has not been started: C:\ProgramData\loantmp\1.0.1.205\LCAssist.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Dropped PE file which has not been started: C:\ProgramData\loantmp\1.0.1.205\loanNPHelper.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Dropped PE file which has not been started: C:\ProgramData\loantmp\1.0.1.205\exten.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Dropped PE file which has not been started: C:\ProgramData\loantmp\1.0.1.205\LoanCal.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Dropped PE file which has not been started: C:\ProgramData\loantmp\1.0.1.205\loancalservice.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Dropped PE file which has not been started: C:\ProgramData\loantmp\1.0.1.205\fixfunction.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Dropped PE file which has not been started: C:\ProgramData\loantmp\1.0.1.205\LCUninst.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe TID: 7188 Thread sleep time: -4062300s >= -30000s Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe TID: 7188 Thread sleep time: -1396450s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber,Product FROM Win32_BaseBoard WHERE (SerialNumber IS NOT NULL)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,Name,ProcessorId FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_0040372C GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime, 0_2_0040372C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00403211 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z, 0_2_00403211
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00817D60 FindFirstFileW,FindClose,FindClose, 5_2_00817D60
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007FAEF0 FindFirstFileW,_memmove,FindNextFileW,FindClose, 5_2_007FAEF0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00817AE0 FindFirstFileW,FindNextFileW,FindClose, 5_2_00817AE0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_007FBCD0 _memset,OleInitialize,SHBrowseForFolderW,OleUninitialize,SHGetPathFromIDListW,FindFirstFileW,FindClose,MessageBoxW,OleUninitialize,OleUninitialize, 5_2_007FBCD0
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00817F20 FindFirstFileW,FindClose,FindClose, 5_2_00817F20
Source: SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Binary or memory string: vmCIAa
Source: LCInstall.exe, 00000005.00000002.3728844678.00000000008F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _VMware_
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe API call chain: ExitProcess graph end node
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083300E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_0083300E
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00402678 LoadLibraryA,GetProcAddress,GetNativeSystemInfo, 0_2_00402678
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00829200 GetProcessHeap,HeapAlloc,InterlockedPopEntrySList,InterlockedPopEntrySList,VirtualAlloc,InterlockedPopEntrySList,VirtualFree,InterlockedPushEntrySList, 5_2_00829200
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0083300E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_0083300E
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_0082B4A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_0082B4A1
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: 5_2_00835869 SetUnhandledExceptionFilter, 5_2_00835869
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Process created: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe "C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe" /I Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00402757 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_00402757
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar, 0_2_00402490
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free, 5_2_0083E57D
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free, 5_2_0083E86B
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW, 5_2_00832B90
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 5_2_0083ED52
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen, 5_2_0083EEEE
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 5_2_0083EE47
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea, 5_2_00840E7F
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 5_2_0083EF49
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 5_2_00840F59
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 5_2_0083F1DA
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 5_2_0083F11A
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 5_2_0083F241
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s, 5_2_0083F27D
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 5_2_0083D921
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement, 5_2_0082FB27
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Code function: GetLocaleInfoA, 5_2_00831E64
Queries the volume information (name, serial number etc) of a device
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\btn_close.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\title.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\bg_install.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\button_setup.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\box_check.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\box_check.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\srollBk.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\scrollBar.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\scrollArrowUp.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\scrollArrowDown.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\srollBk.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\scrollBar.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\scrollArrowUp.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\DirectUI\scrollArrowDown.bmp VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\return.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\browser.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\progress_bar.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\ProgramData\loantmp\1.0.1.205\resource\now_start.png VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\loantmp\1.0.1.205\LCInstall.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00403A96 lstrlenW,GetSystemTimeAsFileTime,GetFileAttributesW,memcpy,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z, 0_2_00403A96
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.30060.94.exe Code function: 0_2_00405C18 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,lstrlenW,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,lstrlenW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA, 0_2_00405C18
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1470314 Sample: SecuriteInfo.com.Win32.Evo-... Startdate: 09/07/2024 Architecture: WINDOWS Score: 96 21 Antivirus detection for dropped file 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 2 other signatures 2->27 6 SecuriteInfo.com.Win32.Evo-gen.30060.94.exe 54 2->6         started        process3 file4 13 C:\ProgramData\loantmp\...\loancalservice.exe, PE32 6->13 dropped 15 C:\ProgramData\loantmp\...\loanNPHelper.dll, PE32 6->15 dropped 17 C:\ProgramData\loantmp\...\fixfunction.dll, PE32 6->17 dropped 19 5 other malicious files 6->19 dropped 29 Contains functionality to register a low level keyboard hook 6->29 10 LCInstall.exe 3 1 6->10         started        signatures5 process6 signatures7 31 Antivirus detection for dropped file 10->31 33 Multi AV Scanner detection for dropped file 10->33 35 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->35 37 2 other signatures 10->37
⊘No contacted IP infos