Windows Analysis Report
be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe

Overview

General Information

Sample name: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe
Analysis ID: 1483221
MD5: 37bdc150af529c0f560f1269dee8fa17
SHA1: d5c9e4dd36a99407c0824478c00d0f97fb26ab2f
SHA256: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb31c0e34c7835baa828af
Tags: exeRedLineStealer
Infos:

Detection

RedLine
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Yara detected RedLine Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops PE files with a suspicious file extension
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: Suspicious Copy From or To System Directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Avira: detected
Found malware configuration
Source: 20.2.RegAsm.exe.700000.0.unpack Malware Configuration Extractor: RedLine {"C2 url": ["45.140.147.183:12245"], "Bot Id": "YT2", "Authorization Header": "1a1f648c602cc3ac1cfdc397a97b9b88"}
Multi AV Scanner detection for dropped file
Source: C:\StrLocalGate\MmReveals.exe (copy) ReversingLabs: Detection: 39%
Source: C:\StrLocalGate\is-RISCU.tmp ReversingLabs: Detection: 39%
Multi AV Scanner detection for submitted file
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe ReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.5% probability
Uses 32bit PE files
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 00000013.00000000.2257986725.0000000000042000.00000002.00000001.01000000.0000000D.sdmp, RegAsm.exe.14.dr
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000013.00000000.2257986725.0000000000042000.00000002.00000001.01000000.0000000D.sdmp, RegAsm.exe.14.dr
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004062D5 FindFirstFileW,FindClose, 3_2_004062D5
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_00402E18 FindFirstFileW, 3_2_00402E18
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 3_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005747B7 GetFileAttributesW,FindFirstFileW,FindClose, 14_2_005747B7
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00573B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 14_2_00573B4F
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00573E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 14_2_00573E72
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 14_2_0057C16C
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057CB81 FindFirstFileW,FindClose, 14_2_0057CB81
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 14_2_0057CC0C
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 14_2_0057F445
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 14_2_0057F5A2
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 14_2_0057F8A3

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 45.140.147.183:12245
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49737 -> 45.140.147.183:12245
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SYNLINQsynlinqdeDE SYNLINQsynlinqdeDE
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: WTYoyXMgGLmyIq.WTYoyXMgGLmyIq replaycode: Name error (3)
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 45.140.147.183
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0058279E InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 14_2_0058279E
Source: global traffic DNS traffic detected: DNS query: WTYoyXMgGLmyIq.WTYoyXMgGLmyIq
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-RISCU.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MmReveals.exe, 00000003.00000000.1652016339.0000000000408000.00000002.00000001.01000000.00000008.sdmp, MmReveals.exe, 00000003.00000002.1749854145.0000000000408000.00000002.00000001.01000000.00000008.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng20
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002873000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002873000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.0000000002821000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000014.00000002.2568169273.000000000289D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000014.00000002.2568169273.000000000289D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002873000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002721000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000014.00000002.2568169273.0000000002829000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Setup.exe, 00000002.00000003.1761393859.00000000022D6000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000004.00000003.1755405797.0000000002586000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.autodesk.com/
Source: Setup.exe, 00000002.00000003.1652253190.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000004.00000003.1664466450.00000000034B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.autodesk.com/0http://www.autodesk.com/0http://www.autodesk.com/
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: MmReveals.exe, 00000003.00000003.1675095566.00000000028A1000.00000004.00000020.00020000.00000000.sdmp, Eco.pif, 0000000E.00000000.1699641380.00000000005D8000.00000002.00000001.01000000.0000000B.sdmp, Eco.pif.5.dr, Glasses.3.dr String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000002.1662881155.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-RISCU.tmp.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: Setup.exe, 00000002.00000003.1652253190.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000002.00000003.1761393859.000000000227D000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000004.00000003.1664466450.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000004.00000003.1755405797.00000000024DD000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.dk-soft.org/
Source: Eco.pif, 0000000E.00000003.2257485805.0000000004EC8000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2257260838.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2315350794.0000000004823000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2259828700.0000000004821000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2266853177.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2266944790.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2260351843.0000000004EDB000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2266772468.0000000003EA2000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2259618326.000000000486B000.00000004.00000800.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2260600980.0000000004861000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2565104285.0000000000702000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, is-RI2MT.tmp.1.dr String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: MmReveals.exe, 00000003.00000003.1677519643.0000000002898000.00000004.00000020.00020000.00000000.sdmp, Miniature.3.dr, Eco.pif.5.dr String found in binary or memory: https://www.globalsign.com/repository/03
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000003.1634957326.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000003.1633297447.00000000024F0000.00000004.00001000.00020000.00000000.sdmp, be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000000.1636308762.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Setup.exe, 00000002.00000003.1657177006.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000002.00000003.1654004225.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000004.00000000.1660124095.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Setup.tmp.2.dr, be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp.0.dr String found in binary or memory: https://www.innosetup.com/
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000003.1634957326.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000003.1633297447.00000000024F0000.00000004.00001000.00020000.00000000.sdmp, be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp, 00000001.00000000.1636308762.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Setup.exe, 00000002.00000003.1657177006.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000002.00000003.1654004225.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Setup.tmp, 00000004.00000000.1660124095.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Setup.tmp.2.dr, be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp.0.dr String found in binary or memory: https://www.remobjects.com/ps
Contains functionality for read data from the clipboard
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 3_2_004050CD
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00584614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 14_2_00584614
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00584416 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 14_2_00584416
Contains functionality to retrieve information about pressed keystrokes
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 3_2_004044A5
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0059CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 14_2_0059CEDF
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00530D68 FindCloseChangeNotification,NtResumeThread, 14_2_00530D68
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005740C1: CreateFileW,DeviceIoControl,CloseHandle, 14_2_005740C1
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00568D11 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 14_2_00568D11
Contains functionality to shutdown / reboot the system
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx, 3_2_00403883
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005755E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 14_2_005755E5
Detected potential crypto function
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_0040497C 3_2_0040497C
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_00406ED2 3_2_00406ED2
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004074BB 3_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0051B020 14_2_0051B020
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005194E0 14_2_005194E0
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00519C80 14_2_00519C80
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005981C8 14_2_005981C8
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00532325 14_2_00532325
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00546432 14_2_00546432
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0054258E 14_2_0054258E
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0051E6F0 14_2_0051E6F0
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053275A 14_2_0053275A
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00590802 14_2_00590802
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005488EF 14_2_005488EF
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005469A4 14_2_005469A4
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00520BE0 14_2_00520BE0
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0056EB95 14_2_0056EB95
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00590C7F 14_2_00590C7F
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053CC81 14_2_0053CC81
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00578CB1 14_2_00578CB1
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00546F16 14_2_00546F16
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005332E9 14_2_005332E9
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053F339 14_2_0053F339
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0052D457 14_2_0052D457
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0052F57E 14_2_0052F57E
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005315E4 14_2_005315E4
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00511663 14_2_00511663
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0051F6A0 14_2_0051F6A0
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005377F3 14_2_005377F3
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053DAD5 14_2_0053DAD5
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00531AD8 14_2_00531AD8
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00549C15 14_2_00549C15
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0052DD14 14_2_0052DD14
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00531EF0 14_2_00531EF0
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053BF06 14_2_0053BF06
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Code function: 20_2_00D5DC74 20_2_00D5DC74
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: String function: 00521A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: String function: 00538A60 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: String function: 00530C42 appears 70 times
Source: C:\StrLocalGate\MmReveals.exe Code function: String function: 004062A3 appears 57 times
PE file contains executable resources (Code or Archives)
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Setup.tmp.2.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Sample file is different than original file name gathered from version info
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000003.1668432847.0000000002358000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000003.1633297447.00000000027DA000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000003.1634957326.000000007FE36000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, 00000000.00000000.1630689613.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Binary or memory string: OriginalFileName vs be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe
Uses 32bit PE files
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: is-RISCU.tmp.1.dr Static PE information: Section: .reloc ZLIB complexity 1.002685546875
Source: classification engine Classification label: mal72.troj.spyw.evad.winEXE@34/46@1/1
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057A51A GetLastError,FormatMessageW, 14_2_0057A51A
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00568BCC AdjustTokenPrivileges,CloseHandle, 14_2_00568BCC
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0056917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 14_2_0056917C
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 3_2_004044A5
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00573FB5 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification, 14_2_00573FB5
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004024FB CoCreateInstance, 3_2_004024FB
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005742AA __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 14_2_005742AA
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp File created: C:\Program Files (x86)\StrLocalGate Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7068:120:WilError_03
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe File created: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\StrLocalGate\MmReveals.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe ReversingLabs: Detection: 36%
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe File read: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe "C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe"
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Process created: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp "C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp" /SL5="$10422,3479677,781312,C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe"
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process created: C:\Program Files (x86)\StrLocalGate\Setup.exe "C:\Program Files (x86)\StrLocalGate\Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process created: C:\StrLocalGate\MmReveals.exe "C:\StrLocalGate\MmReveals.exe"
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Process created: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp "C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp" /SL5="$20426,920064,920064,C:\Program Files (x86)\StrLocalGate\Setup.exe"
Source: C:\StrLocalGate\MmReveals.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Humor Humor.cmd & Humor.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 154571
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TRUEANALOGMINDOC" Pepper
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Lt + Blake + Tranny + Category 154571\i
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\154571\Eco.pif 154571\Eco.pif 154571\i
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 5
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process created: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process created: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Process created: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp "C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp" /SL5="$10422,3479677,781312,C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process created: C:\Program Files (x86)\StrLocalGate\Setup.exe "C:\Program Files (x86)\StrLocalGate\Setup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process created: C:\StrLocalGate\MmReveals.exe "C:\StrLocalGate\MmReveals.exe" Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Process created: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp "C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp" /SL5="$20426,920064,920064,C:\Program Files (x86)\StrLocalGate\Setup.exe" Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Humor Humor.cmd & Humor.cmd & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 154571 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TRUEANALOGMINDOC" Pepper Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Lt + Blake + Tranny + Category 154571\i Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\154571\Eco.pif 154571\Eco.pif 154571\i Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process created: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process created: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: acgenral.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: version.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: wldp.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: propsys.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: profapi.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: edputil.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: netutils.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: slc.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: userenv.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: sppc.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Static file information: File size 4303615 > 1048576
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 00000013.00000000.2257986725.0000000000042000.00000002.00000001.01000000.0000000D.sdmp, RegAsm.exe.14.dr
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000013.00000000.2257986725.0000000000042000.00000002.00000001.01000000.0000000D.sdmp, RegAsm.exe.14.dr
Contains functionality to dynamically determine API calls
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 3_2_004062FC
PE file contains sections with non-standard names
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Static PE information: section name: .didata
Source: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp.0.dr Static PE information: section name: .didata
Source: is-RI2MT.tmp.1.dr Static PE information: section name: .didata
Source: Setup.tmp.2.dr Static PE information: section name: .didata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00538AA5 push ecx; ret 14_2_00538AB8
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Code function: 20_2_06423B5F push 18068B92h; ret 20_2_0642401D
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Code function: 20_2_064242C4 pushad ; ret 20_2_064242DD
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Code function: 20_2_06424B01 pushfd ; retf 20_2_06424B02

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Jump to dropped file
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif File created: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Jump to dropped file
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe File created: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Jump to dropped file
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe File created: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp File created: C:\Users\user\AppData\Local\Temp\is-M0QJK.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp File created: C:\StrLocalGate\MmReveals.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp File created: C:\StrLocalGate\is-RISCU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp File created: C:\Users\user\AppData\Local\Temp\is-SR5HU.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp File created: C:\Program Files (x86)\StrLocalGate\is-RI2MT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp File created: C:\Program Files (x86)\StrLocalGate\Setup.exe (copy) Jump to dropped file
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0059577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 14_2_0059577B
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00525EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 14_2_00525EDA
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005332E9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 14_2_005332E9
Source: C:\Users\user\Desktop\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\StrLocalGate\Setup.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\StrLocalGate\MmReveals.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Stalling execution: Execution stalls by calling Sleep
Source: C:\StrLocalGate\MmReveals.exe Stalling execution: Execution stalls by calling Sleep
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Memory allocated: D30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Memory allocated: 2720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Memory allocated: 2620000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-9OEDA.tmp\Setup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-M0QJK.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SR5HU.tmp\_isetup\_setup64.tmp Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif API coverage: 5.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\timeout.exe TID: 5480 Thread sleep count: 40 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe TID: 4960 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe TID: 4548 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004062D5 FindFirstFileW,FindClose, 3_2_004062D5
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_00402E18 FindFirstFileW, 3_2_00402E18
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 3_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005747B7 GetFileAttributesW,FindFirstFileW,FindClose, 14_2_005747B7
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00573B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 14_2_00573B4F
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00573E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 14_2_00573E72
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 14_2_0057C16C
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057CB81 FindFirstFileW,FindClose, 14_2_0057CB81
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 14_2_0057CC0C
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 14_2_0057F445
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 14_2_0057F5A2
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 14_2_0057F8A3
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00525D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 14_2_00525D13
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Eco.pif, 0000000E.00000003.2331706857.0000000001604000.00000004.00000020.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2320733420.0000000001602000.00000004.00000020.00020000.00000000.sdmp, Eco.pif, 0000000E.00000003.2330323847.0000000001603000.00000004.00000020.00020000.00000000.sdmp, Eco.pif, 0000000E.00000002.2334396849.0000000001604000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2584519297.00000000058D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\is-5MGM4.tmp\be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp Process information queried: ProcessInformation Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005843B9 BlockInput, 14_2_005843B9
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00525240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 14_2_00525240
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00545BDC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 14_2_00545BDC
Contains functionality to dynamically determine API calls
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 3_2_004062FC
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005686B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 14_2_005686B0
Enables debug privileges
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053A284 SetUnhandledExceptionFilter, 14_2_0053A284
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053A2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 14_2_0053A2B5
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Memory written: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe base: 700000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Memory written: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe base: 700000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Memory written: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe base: 418000 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0056914C LogonUserW, 14_2_0056914C
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00525240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 14_2_00525240
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00571932 SendInput,keybd_event, 14_2_00571932
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057504F mouse_event, 14_2_0057504F
Creates a process in suspended mode (likely to inject code)
Source: C:\StrLocalGate\MmReveals.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Humor Humor.cmd & Humor.cmd & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 154571 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TRUEANALOGMINDOC" Pepper Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Lt + Blake + Tranny + Category 154571\i Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\154571\Eco.pif 154571\Eco.pif 154571\i Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process created: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Process created: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_005686B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 14_2_005686B0
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00574D89 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 14_2_00574D89
Source: MmReveals.exe, 00000003.00000002.1749959907.000000000041F000.00000004.00000001.01000000.00000008.sdmp, MmReveals.exe, 00000003.00000002.1750600445.00000000028A5000.00000004.00000020.00020000.00000000.sdmp, Eco.pif, 0000000E.00000000.1699550344.00000000005C5000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Eco.pif Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0053878B cpuid 14_2_0053878B
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0057E0CA GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW, 14_2_0057E0CA
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00550652 GetUserNameW, 14_2_00550652
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_0054409A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 14_2_0054409A
Source: C:\StrLocalGate\MmReveals.exe Code function: 3_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 3_2_00406805
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: RegAsm.exe, 00000014.00000002.2584603940.00000000058DB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000014.00000002.2585074100.0000000005942000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 14.3.Eco.pif.486a450.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.RegAsm.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000003.2257485805.0000000004EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2257260838.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2315350794.0000000004823000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2317192962.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2565104285.0000000000702000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259828700.0000000004821000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2266853177.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2316981318.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260248187.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2266944790.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259567795.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260441214.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260351843.0000000004EDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2266772468.0000000003EA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2317320057.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260198982.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260600980.0000000004821000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2257336074.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259618326.000000000486B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259650438.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260600980.0000000004861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259764346.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Eco.pif PID: 2004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 4856, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ElectrumE#
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $kq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000014.00000002.2584603940.00000000058DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\*
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.walletLRkq`u
Source: RegAsm.exe, 00000014.00000002.2584603940.00000000058DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets\*
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ExodusE#
Source: RegAsm.exe, 00000014.00000002.2584603940.00000000058DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\*app-store*p
Source: RegAsm.exe, 00000014.00000002.2584603940.00000000058DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets\*
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $kq&%localappdata%\Coinomi\Coinomi\walletsLRkq
Source: RegAsm.exe, 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $kq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\154571\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\ Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: Eco.pif Binary or memory string: WIN_81
Source: Eco.pif Binary or memory string: WIN_XP
Source: Eco.pif Binary or memory string: WIN_XPe
Source: Eco.pif.5.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyteP
Source: Eco.pif Binary or memory string: WIN_VISTA
Source: Eco.pif Binary or memory string: WIN_7
Source: Eco.pif Binary or memory string: WIN_8
Yara detected Credential Stealer
Source: Yara match File source: 00000014.00000002.2568169273.00000000027B4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2568169273.00000000028B4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 4856, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 14.3.Eco.pif.486a450.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.RegAsm.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000003.2257485805.0000000004EC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2257260838.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2315350794.0000000004823000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2317192962.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.2565104285.0000000000702000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259828700.0000000004821000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2266853177.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2316981318.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260248187.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2266944790.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259567795.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260441214.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260351843.0000000004EDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2266772468.0000000003EA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2317320057.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260198982.0000000004A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260600980.0000000004821000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2257336074.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259618326.000000000486B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259650438.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2260600980.0000000004861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2259764346.00000000048DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Eco.pif PID: 2004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 4856, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00586733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 14_2_00586733
Source: C:\Users\user\AppData\Local\Temp\154571\Eco.pif Code function: 14_2_00586BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 14_2_00586BF7
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483221 Sample: be5bb7f05c4f8de4d393134b63a... Startdate: 26/07/2024 Architecture: WINDOWS Score: 72 65 WTYoyXMgGLmyIq.WTYoyXMgGLmyIq 2->65 71 Found malware configuration 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 Multi AV Scanner detection for dropped file 2->75 77 6 other signatures 2->77 11 be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe 2 2->11         started        signatures3 process4 file5 53 be5bb7f05c4f8de4d3...6bf8a05e3ad3fb3.tmp, PE32 11->53 dropped 14 be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.tmp 5 16 11->14         started        process6 file7 57 C:\StrLocalGate\is-RISCU.tmp, PE32 14->57 dropped 59 C:\StrLocalGate\MmReveals.exe (copy), PE32 14->59 dropped 61 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 14->61 dropped 63 2 other files (none is malicious) 14->63 dropped 17 MmReveals.exe 68 14->17         started        21 Setup.exe 2 14->21         started        process8 file9 45 C:\Users\user\AppData\Local\Temp45d, PDP-11 17->45 dropped 69 Found stalling execution ending in API Sleep call 17->69 23 cmd.exe 3 17->23         started        47 C:\Users\user\AppData\Local\...\Setup.tmp, PE32 21->47 dropped 27 Setup.tmp 3 12 21->27         started        signatures10 process11 file12 49 C:\Users\user\AppData\Local\Temp\...co.pif, PE32 23->49 dropped 79 Drops PE files with a suspicious file extension 23->79 29 Eco.pif 1 23->29         started        33 cmd.exe 2 23->33         started        35 conhost.exe 23->35         started        37 7 other processes 23->37 51 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 27->51 dropped signatures13 process14 file15 55 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 29->55 dropped 91 Found stalling execution ending in API Sleep call 29->91 93 Writes to foreign memory regions 29->93 95 Injects a PE file into a foreign processes 29->95 39 RegAsm.exe 5 4 29->39         started        43 RegAsm.exe 29->43         started        signatures16 process17 dnsIp18 67 45.140.147.183, 12245, 49737 SYNLINQsynlinqdeDE United Kingdom 39->67 81 Found many strings related to Crypto-Wallets (likely being stolen) 39->81 83 Tries to harvest and steal browser information (history, passwords, etc) 39->83 85 Tries to steal Crypto Currency Wallets 39->85 87 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 43->87 89 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 43->89 signatures19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.140.147.183
 unknown United Kingdom
44486 SYNLINQsynlinqdeDE true

Contacted Domains

Name IP Active
WTYoyXMgGLmyIq.WTYoyXMgGLmyIq unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
45.140.147.183:12245 true
  • Avira URL Cloud: safe
 unknown