Windows Analysis Report
sv6ieteV0j.exe

Overview

General Information

Sample name: sv6ieteV0j.exe
renamed because original name is a hash value
Original sample name: 201ec2f7b087e3ca36f271b35c662d3c.exe
Analysis ID: 1481158
MD5: 201ec2f7b087e3ca36f271b35c662d3c
SHA1: 99f1146550f28dd1828ccf2962df1b8182d6d8a6
SHA256: c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69
Tags: exenjratRAT
Infos:

Detection

Njrat, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Njrat
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious names
Disables zone checking for all users
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the windows firewall
Protects its processes via BreakOnTermination flag
Uses netsh to modify the Windows network and firewall settings
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
NjRAT RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.
  • AQUATIC PANDA
  • Earth Lusca
  • Operation C-Major
  • The Gorgon Group
 https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: sv6ieteV0j.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\steam.exe Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe Avira: detection malicious, Label: TR/Dropper.Gen
Found malware configuration
Source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Njrat {"Host": "147.185.221.21", "Port": "11656", "Version": "0.7d", "Campaign ID": "vpn55", "Install Name": "steam.exe", "Install Dir": "AppData", "Network Seprator": "|'|'|"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe Virustotal: Detection: 33% Perma Link
Source: C:\Users\user\AppData\Roaming\steam.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Roaming\steam.exe Virustotal: Detection: 33% Perma Link
Multi AV Scanner detection for submitted file
Source: sv6ieteV0j.exe ReversingLabs: Detection: 87%
Source: sv6ieteV0j.exe Virustotal: Detection: 33% Perma Link
Yara detected Njrat
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4552611168.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sv6ieteV0j.exe PID: 5780, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 6020, type: MEMORYSTR
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\steam.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: sv6ieteV0j.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: sv6ieteV0j.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\sv6ieteV0j.exe File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll Jump to behavior
Source: sv6ieteV0j.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectII\x64\Release\VSProjectII64.pdb source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 147.185.221.21
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 147.185.221.21:11656
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 147.185.221.21 147.185.221.21
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SALSGIVERUS SALSGIVERUS
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: unknown TCP traffic detected without corresponding DNS query: 147.185.221.21
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: <col width="370"> <col width="80"> <col width="120"><td style="text-align:left"><td style="text-align:right"><td style="text-align:center"></a></td> <a href="<td> <a href="/X/IModifyPathIhttps://www.facebook.com/pages/Revo-Uninstaller/53526911789 equals www.facebook.com (Facebook)
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0=
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://ocsp.digicert.com0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://ocsp.digicert.com0W
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: http://www.google.com/search?q=MACHINE
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: https://www.revouninstaller.com
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: https://www.revouninstaller.com/frpromo/
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: https://www.revouninstaller.com/revo-uninstaller-mobile-qr-and-link/https://www.revouninstaller.com/
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: https://www.revouninstaller.com/update.xmlREVUNINSTALLERINFOVERSIONBUTTON_ICOBUTTON_TEXTBUTTON_TARGE
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr String found in binary or memory: https://www.revouninstaller.comAffHome

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, kl.cs .Net Code: VKCodeToUnicode
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, kl.cs .Net Code: VKCodeToUnicode
Source: 7.2.steam.exe.3285a28.0.raw.unpack, kl.cs .Net Code: VKCodeToUnicode

E-Banking Fraud
barindex
Yara detected Njrat
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4552611168.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sv6ieteV0j.exe PID: 5780, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 6020, type: MEMORYSTR

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\steam.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Code function: 0_2_00007FF848F636D5 0_2_00007FF848F636D5
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Code function: 0_2_00007FF848F6060E 0_2_00007FF848F6060E
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Code function: 0_2_00007FF8491B3BED 0_2_00007FF8491B3BED
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF848F836D5 3_2_00007FF848F836D5
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF848F8060E 3_2_00007FF848F8060E
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF8491D33EA 3_2_00007FF8491D33EA
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF8491DEB0E 3_2_00007FF8491DEB0E
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF8491DC975 3_2_00007FF8491DC975
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF8491DCFAC 3_2_00007FF8491DCFAC
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF8491D3BED 3_2_00007FF8491D3BED
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 7_2_00007FF848F836D5 7_2_00007FF848F836D5
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 9_2_00007FF848F636D5 9_2_00007FF848F636D5
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 9_2_00007FF848F6060E 9_2_00007FF848F6060E
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 11_2_00007FF848F836D5 11_2_00007FF848F836D5
Sample file is different than original file name gathered from version info
Source: sv6ieteV0j.exe, 00000000.00000002.2209107991.0000000012740000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWindowsApplication15.exeL vs sv6ieteV0j.exe
Source: sv6ieteV0j.exe, 00000000.00000002.2209107991.0000000013561000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRevoUnin.exeB vs sv6ieteV0j.exe
Source: sv6ieteV0j.exe, 00000000.00000002.2203751961.00000000027AD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWindowsApplication15.exeL vs sv6ieteV0j.exe
Source: sv6ieteV0j.exe, 00000000.00000000.2087357855.000000000023E000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameWindowsApplication15.exeL vs sv6ieteV0j.exe
Source: sv6ieteV0j.exe, 00000000.00000002.2224513022.0000000023EEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWi vs sv6ieteV0j.exe
Source: sv6ieteV0j.exe Binary or memory string: OriginalFilenameWindowsApplication15.exeL vs sv6ieteV0j.exe
Source: sv6ieteV0j.exe Binary or memory string: OriginalFilenameRevoUnin.exeB vs sv6ieteV0j.exe
Uses 32bit PE files
Source: sv6ieteV0j.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: sv6ieteV0j.exe, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: sv6ieteV0j.exe, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: sv6ieteV0j.exe, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: steam.exe.0.dr, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: steam.exe.0.dr, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: steam.exe.0.dr, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: dbff472320d89464fd01ee82ecd1dabe.exe.3.dr, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: dbff472320d89464fd01ee82ecd1dabe.exe.3.dr, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: dbff472320d89464fd01ee82ecd1dabe.exe.3.dr, Ni7vpKpZVHGkY9ZkUb.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.phis.troj.adwa.spyw.evad.winEXE@9/5@0/1
Source: C:\Users\user\Desktop\sv6ieteV0j.exe File created: C:\Users\user\AppData\Roaming\steam.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1784:120:WilError_03
Source: C:\Users\user\AppData\Roaming\steam.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Roaming\steam.exe Mutant created: \Sessions\1\BaseNamedObjects\dbff472320d89464fd01ee82ecd1dabe
Source: sv6ieteV0j.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sv6ieteV0j.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\sv6ieteV0j.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: sv6ieteV0j.exe, 00000000.00000002.2209107991.0000000012D10000.00000004.00000800.00020000.00000000.sdmp, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sv6ieteV0j.exe, 00000000.00000002.2209107991.0000000012D10000.00000004.00000800.00020000.00000000.sdmp, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sv6ieteV0j.exe, 00000000.00000002.2209107991.0000000012D10000.00000004.00000800.00020000.00000000.sdmp, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sv6ieteV0j.exe, 00000000.00000002.2209107991.0000000012D10000.00000004.00000800.00020000.00000000.sdmp, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sv6ieteV0j.exe ReversingLabs: Detection: 87%
Source: sv6ieteV0j.exe Virustotal: Detection: 33%
Source: sv6ieteV0j.exe String found in binary or memory: ProductIconInstaller\Products\SOFTWARE\Microsoft\Installer\Products\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SlowInfoCache\Installer\UserData\UninstallStringMsiExec.exe /XMicrosoft Edge WebView2 RuntimeSystemComponentctor.dllDisplayIconInstallLocation--uninstall-app-id=--profile-InstallDate%02d.%02d.%dPublisherHelpLinkCommentsParentKeyNameViewType\InstallPropertiesSOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\\Products\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallWindowsInstallerEstimatedSizedeque<T> too long
Source: sv6ieteV0j.exe String found in binary or memory: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
Source: sv6ieteV0j.exe String found in binary or memory: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
Source: sv6ieteV0j.exe String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: sv6ieteV0j.exe String found in binary or memory: <StopOnIdleEnd>true</StopOnIdleEnd>
Source: sv6ieteV0j.exe String found in binary or memory: will no longer auto-start!
Source: sv6ieteV0j.exe String found in binary or memory: Set to auto-start forAll users
Source: sv6ieteV0j.exe String found in binary or memory: Set to auto-start from+Registry: Run - on every startup of WindowsERegistry: RunOnce - run only once, during the next startup of WindowsPA,Startup folder - on every startup of Windows
Source: sv6ieteV0j.exe String found in binary or memory: Removed from auto-starting,Removed not running items from auto-starting-Removed all disabled items from auto-starting
Source: sv6ieteV0j.exe String found in binary or memory: The 'Windows Apps' module lists all installed Windows apps and helps you to uninstall any of them with a single click. Some of the apps produced by Microsoft come pre-installed with the operating system, others are installed through the Microsoft Store.More information about any app can be found from the context menu.:Analyzing and starting the App's default uninstall command
Source: C:\Users\user\Desktop\sv6ieteV0j.exe File read: C:\Users\user\Desktop\sv6ieteV0j.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\sv6ieteV0j.exe "C:\Users\user\Desktop\sv6ieteV0j.exe"
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process created: C:\Users\user\AppData\Roaming\steam.exe "C:\Users\user\AppData\Roaming\steam.exe"
Source: C:\Users\user\AppData\Roaming\steam.exe Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\steam.exe" "steam.exe" ENABLE
Source: C:\Windows\System32\netsh.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\steam.exe "C:\Users\user\AppData\Roaming\steam.exe" ..
Source: unknown Process created: C:\Users\user\AppData\Roaming\steam.exe "C:\Users\user\AppData\Roaming\steam.exe" ..
Source: unknown Process created: C:\Users\user\AppData\Roaming\steam.exe "C:\Users\user\AppData\Roaming\steam.exe" ..
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process created: C:\Users\user\AppData\Roaming\steam.exe "C:\Users\user\AppData\Roaming\steam.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\steam.exe" "steam.exe" ENABLE Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\sv6ieteV0j.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: sv6ieteV0j.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: sv6ieteV0j.exe Static file information: File size 15493872 > 1048576
Source: C:\Users\user\Desktop\sv6ieteV0j.exe File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll Jump to behavior
Source: sv6ieteV0j.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Work\VSRevo\Windows\Projects\VSProjectII\x64\Release\VSProjectII64.pdb source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: sv6ieteV0j.exe, Ni7vpKpZVHGkY9ZkUb.cs .Net Code: Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777342)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777269)),Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777253))})
Source: steam.exe.0.dr, Ni7vpKpZVHGkY9ZkUb.cs .Net Code: Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777342)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777269)),Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777253))})
Source: dbff472320d89464fd01ee82ecd1dabe.exe.3.dr, Ni7vpKpZVHGkY9ZkUb.cs .Net Code: Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777342)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777269)),Type.GetTypeFromHandle(jOJcPkGFba5FfNnOvu.glwU51TjOH(16777253))})
.NET source code contains potential unpacker
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, OK.cs .Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, OK.cs .Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 7.2.steam.exe.3285a28.0.raw.unpack, OK.cs .Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Code function: 0_2_00007FF848F62269 pushad ; retf 0_2_00007FF848F62282
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Code function: 0_2_00007FF8491B0940 push ds; retf 5F5Ch 0_2_00007FF8491B099F
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Code function: 0_2_00007FF848F61474 pusha ; retf 0_2_00007FF848F62268
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF848F84E63 push ss; retf 3_2_00007FF848F84E65
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 3_2_00007FF8491D0940 push ds; retf 5F5Ah 3_2_00007FF8491D099F
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 7_2_00007FF848F84E63 push ss; retf 7_2_00007FF848F84E65
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 7_2_00007FF8491D0940 push ds; retf 5F5Ah 7_2_00007FF8491D099F
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 9_2_00007FF848F62269 pushad ; retf 9_2_00007FF848F62282
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 9_2_00007FF848F6220A pusha ; retf 9_2_00007FF848F62268
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 9_2_00007FF8491B0940 push ds; retf 5F5Ch 9_2_00007FF8491B099F
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 11_2_00007FF848F84E63 push ss; retf 11_2_00007FF848F84E65
Source: C:\Users\user\AppData\Roaming\steam.exe Code function: 11_2_00007FF8491D0940 push ds; retf 5F5Ah 11_2_00007FF8491D099F
Source: sv6ieteV0j.exe, Ni7vpKpZVHGkY9ZkUb.cs High entropy of concatenated method names: 'f7rtRVHwO2', 'f9UtU12u5A', 'DhftB4KPc1', 'hvSt04nqZv', 'D78t7SpsGQ', 'EoxtaWgEXn', 'lJVUwkFDDq', 'zfNXYKYms', 'Cy6pxejBd', 'PaVtFO00G'
Source: steam.exe.0.dr, Ni7vpKpZVHGkY9ZkUb.cs High entropy of concatenated method names: 'f7rtRVHwO2', 'f9UtU12u5A', 'DhftB4KPc1', 'hvSt04nqZv', 'D78t7SpsGQ', 'EoxtaWgEXn', 'lJVUwkFDDq', 'zfNXYKYms', 'Cy6pxejBd', 'PaVtFO00G'
Source: dbff472320d89464fd01ee82ecd1dabe.exe.3.dr, Ni7vpKpZVHGkY9ZkUb.cs High entropy of concatenated method names: 'f7rtRVHwO2', 'f9UtU12u5A', 'DhftB4KPc1', 'hvSt04nqZv', 'D78t7SpsGQ', 'EoxtaWgEXn', 'lJVUwkFDDq', 'zfNXYKYms', 'Cy6pxejBd', 'PaVtFO00G'
Drops PE files
Source: C:\Users\user\Desktop\sv6ieteV0j.exe File created: C:\Users\user\AppData\Roaming\steam.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\steam.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe Jump to dropped file

Boot Survival
barindex
Creates autostart registry keys with suspicious names
Source: C:\Users\user\AppData\Roaming\steam.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbff472320d89464fd01ee82ecd1dabe Jump to behavior
Drops PE files to the startup folder
Source: C:\Users\user\AppData\Roaming\steam.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\AppData\Roaming\steam.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Roaming\steam.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbff472320d89464fd01ee82ecd1dabe Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbff472320d89464fd01ee82ecd1dabe Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbff472320d89464fd01ee82ecd1dabe Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dbff472320d89464fd01ee82ecd1dabe Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Memory allocated: A90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Memory allocated: 2730000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Memory allocated: 1A730000 memory commit | memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 1220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 2F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 1AF20000 memory commit | memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 8E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 25F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 1A5F0000 memory commit | memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: AB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 27A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 1A7A0000 memory commit | memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 1430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 3280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Memory allocated: 1B280000 memory commit | memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Roaming\steam.exe Window / User API: threadDelayed 3620 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Window / User API: threadDelayed 1010 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Window / User API: threadDelayed 4740 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Window / User API: foregroundWindowGot 1773 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\sv6ieteV0j.exe TID: 5608 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe TID: 1080 Thread sleep time: -1010000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe TID: 1080 Thread sleep time: -4740000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe TID: 5420 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe TID: 1308 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe TID: 2436 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: steam.exe, 00000003.00000002.4550244197.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000005.00000002.2300075796.0000017D7B45A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Roaming\steam.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\steam.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, kl.cs Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, kl.cs Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, OK.cs Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Process created: C:\Users\user\AppData\Roaming\steam.exe "C:\Users\user\AppData\Roaming\steam.exe" Jump to behavior
Source: steam.exe, 00000003.00000002.4595428330.000000002419A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerh
Source: steam.exe, 00000003.00000002.4595428330.000000002419A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerjavapa
Source: steam.exe, 00000003.00000002.4595428330.000000002419A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerf
Source: steam.exe, 00000003.00000002.4552611168.0000000003995000.00000004.00000800.00020000.00000000.sdmp, steam.exe, 00000003.00000002.4595428330.000000002419A000.00000004.00000020.00020000.00000000.sdmp, steam.exe, 00000003.00000002.4552611168.0000000002F95000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: steam.exe, 00000003.00000002.4595428330.000000002419A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerL
Source: sv6ieteV0j.exe, steam.exe.0.dr, dbff472320d89464fd01ee82ecd1dabe.exe.3.dr Binary or memory string: TrayNotifyWndShell_TrayWndHunter ModeHunter Window SizeHunter LeftHunter RightHunter TopHunter BottomHunter Window AOTSDHunter TransparencyStart Hunter.lnk\Microsoft\Internet Explorer\Quick LaunchSysListView32SHELLDLL_DefViewToolbarWindow32SysPagerReBarWindow3225%50%75%\Explorer.exe" /hunter/create /XML /tn "Revo Uninstaller Hunter Mode" schtasks.exe/Delete /TN "Revo Uninstaller Hunter Mode" /F 8
Source: steam.exe, 00000003.00000002.4552611168.0000000003995000.00000004.00000800.00020000.00000000.sdmp, steam.exe, 00000003.00000002.4595428330.000000002419A000.00000004.00000020.00020000.00000000.sdmp, steam.exe, 00000003.00000002.4552611168.0000000002F95000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Managerx
Source: steam.exe, 00000003.00000002.4595428330.000000002419A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerL2\Drive
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\steam.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\sv6ieteV0j.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disables zone checking for all users
Source: C:\Users\user\AppData\Roaming\steam.exe Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS Jump to behavior
Modifies the windows firewall
Source: C:\Users\user\AppData\Roaming\steam.exe Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\steam.exe" "steam.exe" ENABLE
Uses netsh to modify the Windows network and firewall settings
Source: C:\Users\user\AppData\Roaming\steam.exe Process created: C:\Windows\System32\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\steam.exe" "steam.exe" ENABLE

Stealing of Sensitive Information
barindex
Yara detected Njrat
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4552611168.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sv6ieteV0j.exe PID: 5780, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 6020, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: sv6ieteV0j.exe, type: SAMPLE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.12740788.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.sv6ieteV0j.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.12740788.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.2087309031.00000000001E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2209107991.0000000012740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Roaming\steam.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected Njrat
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.b20000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.33c58b0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.steam.exe.3285a28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2203607287.0000000000B20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2203751961.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2488138672.000000000327E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4552611168.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: sv6ieteV0j.exe PID: 5780, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 360, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: steam.exe PID: 6020, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: sv6ieteV0j.exe, type: SAMPLE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.12740788.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.sv6ieteV0j.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.sv6ieteV0j.exe.12740788.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.2087309031.00000000001E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2209107991.0000000012740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Roaming\steam.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1481158 Sample: sv6ieteV0j.exe Startdate: 25/07/2024 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus detection for dropped file 2->38 40 13 other signatures 2->40 8 sv6ieteV0j.exe 1 9 2->8         started        11 steam.exe 4 2->11         started        13 steam.exe 4 2->13         started        15 steam.exe 5 2->15         started        process3 file4 28 C:\Users\user\AppData\Roaming\steam.exe, PE32 8->28 dropped 30 C:\Users\user\AppData\...\sv6ieteV0j.exe.log, ASCII 8->30 dropped 17 steam.exe 4 5 8->17         started        process5 dnsIp6 32 147.185.221.21, 11656, 49716 SALSGIVERUS United States 17->32 26 C:\...\dbff472320d89464fd01ee82ecd1dabe.exe, PE32 17->26 dropped 42 Antivirus detection for dropped file 17->42 44 Multi AV Scanner detection for dropped file 17->44 46 Protects its processes via BreakOnTermination flag 17->46 48 6 other signatures 17->48 22 netsh.exe 2 17->22         started        file7 signatures8 process9 process10 24 conhost.exe 22->24         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
147.185.221.21
 unknown United States
12087 SALSGIVERUS true