Windows Analysis Report
7Xex8yR90g.exe

Overview

General Information

Sample name: 7Xex8yR90g.exe
renamed because original name is a hash value
Original sample name: 8242342835f51d7321b9ef1db28b40a0N.exe
Analysis ID: 1483223
MD5: 8242342835f51d7321b9ef1db28b40a0
SHA1: e863d41d7641b3b9dd9fb9f6a73c5e512a84f512
SHA256: f9b6fbded3e18fa7e6d458d236bb28e14f7276209879d03a60a973b1f2723d49
Tags: exe
Infos:

Detection

Mars Stealer, Stealc, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Mars stealer
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found evasive API chain (may stop execution after checking computer name)
Found evasive API chain (may stop execution after checking locale)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Writes to foreign memory regions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection

barindex
Source: 7Xex8yR90g.exe Avira: detected
Source: http://94.228.166.55/924cf5c06b0c4fee.php Avira URL Cloud: Label: malware
Source: 2.2.RegAsm.exe.400000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://94.228.166.55/924cf5c06b0c4fee.php", "Botnet": "default"}
Source: 2.2.RegAsm.exe.400000.0.unpack Malware Configuration Extractor: Vidar {"C2 url": "http://94.228.166.55/924cf5c06b0c4fee.php"}
Source: 7Xex8yR90g.exe ReversingLabs: Detection: 100%
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: 7Xex8yR90g.exe Joe Sandbox ML: detected
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 10
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 07
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 20
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 24
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetProcAddress
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: LoadLibraryA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrcatA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: OpenEventA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateEventA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Sleep
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetUserDefaultLangID
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualAllocExNuma
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetSystemInfo
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HeapAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetComputerNameA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrcpyA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetProcessHeap
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetCurrentProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrlenA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ExitProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetSystemTime
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SystemTimeToFileTime
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: advapi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: gdi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: user32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: crypt32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ntdll.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetUserNameA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateDCA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetDeviceCaps
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ReleaseDC
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CryptStringToBinaryA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sscanf
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VMwareVMware
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HAL9TH
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: JohnDoe
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DISPLAY
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %hu/%hu/%hu
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: http://94.228.166.55
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: /924cf5c06b0c4fee.php
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: /baf849bbe7c30324/
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: default
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetFileAttributesA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalLock
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HeapFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetFileSize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalSize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: IsWow64Process
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Process32Next
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLocalTime
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FreeLibrary
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetTimeZoneInformation
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetSystemPowerStatus
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetVolumeInformationA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Process32First
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLocaleInfoA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetModuleFileNameA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DeleteFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FindNextFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: LocalFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FindClose
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: LocalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetFileSizeEx
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SetFilePointer
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: WriteFile
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FindFirstFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CopyFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualProtect
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLastError
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrcpynA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: MultiByteToWideChar
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: WideCharToMultiByte
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: OpenProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: TerminateProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetCurrentProcessId
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: gdiplus.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ole32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: bcrypt.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: wininet.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: shlwapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: shell32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: psapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: rstrtmgr.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SelectObject
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BitBlt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DeleteObject
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateCompatibleDC
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipGetImageEncoders
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdiplusStartup
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdiplusShutdown
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipSaveImageToStream
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipDisposeImage
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetHGlobalFromStream
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CoUninitialize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CoInitialize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CoCreateInstance
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptDecrypt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptSetProperty
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptDestroyKey
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetWindowRect
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetDesktopWindow
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetDC
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CloseWindow
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: wsprintfA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CharToOemW
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: wsprintfW
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegQueryValueExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegEnumKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegOpenKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegCloseKey
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegEnumValueA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CryptBinaryToStringA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CryptUnprotectData
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SHGetFolderPathA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ShellExecuteExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetOpenUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetConnectA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetCloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetOpenA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HttpSendRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HttpOpenRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetCrackUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: StrCmpCA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: StrStrA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: StrCmpCW
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: PathMatchSpecA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetModuleFileNameExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RmStartSession
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RmRegisterResources
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RmGetList
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RmEndSession
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_open
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_step
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_column_text
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_finalize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_close
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_column_bytes
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3_column_blob
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: encrypted_key
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: PATH
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: NSS_Init
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: NSS_Shutdown
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: PK11_FreeSlot
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: PK11_Authenticate
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: C:\ProgramData\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: browser:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: profile:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: url:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: login:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: password:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Opera
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: OperaGX
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Network
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: cookies
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: .txt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: TRUE
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FALSE
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: autofill
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: history
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: cc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: name:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: month:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: year:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: card:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Cookies
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Login Data
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Web Data
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: History
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: logins.json
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: formSubmitURL
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: usernameField
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: encryptedUsername
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: encryptedPassword
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: guid
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: cookies.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: formhistory.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: places.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: plugins
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Local Extension Settings
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Sync Extension Settings
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: IndexedDB
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Opera Stable
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Opera GX Stable
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CURRENT
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: chrome-extension_
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Local State
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: profiles.ini
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: chrome
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: opera
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: firefox
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: wallets
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %08lX%04lX%lu
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ProductName
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: x32
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: x64
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ProcessorNameString
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DisplayName
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DisplayVersion
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Network Info:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - IP: IP?
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Country: ISO?
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: System Summary:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - HWID:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - OS:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Architecture:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - UserName:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Computer Name:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Local Time:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - UTC:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Language:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Keyboards:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Laptop:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Running Path:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - CPU:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Threads:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Cores:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - RAM:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - Display Resolution:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: - GPU:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: User Agents:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Installed Apps:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: All Users:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Current User:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Process List:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: system_info.txt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: freebl3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: mozglue.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: msvcp140.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: nss3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: softokn3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: vcruntime140.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \Temp\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: .exe
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: runas
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: open
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: /c start
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %DESKTOP%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %APPDATA%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %USERPROFILE%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %DOCUMENTS%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %PROGRAMFILES%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %RECENT%
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: *.lnk
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: files
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \discord\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \Local Storage\leveldb
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \Telegram Desktop\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: key_datas
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: map*
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: F8806DD0C461824F*
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Telegram
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Tox
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: *.tox
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: *.ini
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Password
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 00000001
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 00000002
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 00000003
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: 00000004
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Pidgin
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \.purple\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: accounts.xml
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: token:
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Software\Valve\Steam
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SteamPath
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \config\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ssfn*
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: config.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DialogConfig.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: libraryfolders.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: loginusers.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \Steam\
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sqlite3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: browsers
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: done
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: soft
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: \Discord\tokens.txt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: https
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: POST
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HTTP/1.1
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: hwid
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: build
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: token
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: file_name
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: file
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: message
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: screenshot.jpg
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetProcAddress
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: LoadLibraryA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrcatA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: OpenEventA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateEventA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Sleep
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetUserDefaultLangID
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualAllocExNuma
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetSystemInfo
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HeapAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetComputerNameA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrcpyA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetProcessHeap
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetCurrentProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrlenA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ExitProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetSystemTime
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SystemTimeToFileTime
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: advapi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: gdi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: user32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: crypt32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ntdll.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetUserNameA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateDCA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetDeviceCaps
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ReleaseDC
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CryptStringToBinaryA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: sscanf
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VMwareVMware
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HAL9TH
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: JohnDoe
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DISPLAY
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: %hu/%hu/%hu
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: http://94.228.166.55
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: /924cf5c06b0c4fee.php
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: /baf849bbe7c30324/
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: default
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetFileAttributesA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalLock
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HeapFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetFileSize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalSize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: IsWow64Process
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Process32Next
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLocalTime
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FreeLibrary
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetTimeZoneInformation
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetSystemPowerStatus
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetVolumeInformationA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: Process32First
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLocaleInfoA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetModuleFileNameA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DeleteFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FindNextFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: LocalFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FindClose
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: LocalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetFileSizeEx
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SetFilePointer
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: WriteFile
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: FindFirstFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CopyFileA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: VirtualProtect
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetLastError
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: lstrcpynA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: MultiByteToWideChar
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: WideCharToMultiByte
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GlobalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: OpenProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: TerminateProcess
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetCurrentProcessId
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: gdiplus.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ole32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: bcrypt.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: wininet.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: shlwapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: shell32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: psapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: rstrtmgr.dll
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SelectObject
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BitBlt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: DeleteObject
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateCompatibleDC
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipGetImageEncoders
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdiplusStartup
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdiplusShutdown
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipSaveImageToStream
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipDisposeImage
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GdipFree
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetHGlobalFromStream
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CoUninitialize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CoInitialize
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CoCreateInstance
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptDecrypt
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptSetProperty
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptDestroyKey
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetWindowRect
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetDesktopWindow
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetDC
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CloseWindow
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: wsprintfA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CharToOemW
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: wsprintfW
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegQueryValueExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegEnumKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegOpenKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegCloseKey
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: RegEnumValueA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CryptBinaryToStringA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: CryptUnprotectData
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: SHGetFolderPathA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: ShellExecuteExA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetOpenUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetConnectA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetCloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetOpenA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HttpSendRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: HttpOpenRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: InternetCrackUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: StrCmpCA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: StrStrA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: StrCmpCW
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: PathMatchSpecA
Source: 2.2.RegAsm.exe.400000.0.unpack String decryptor: GetModuleFileNameExA
Source: 7Xex8yR90g.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 7Xex8yR90g.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_002126FF FindFirstFileExW, 0_2_002126FF

Networking

barindex
Source: Malware configuration extractor URLs: http://94.228.166.55/924cf5c06b0c4fee.php
Source: Malware configuration extractor URLs: http://94.228.166.55/924cf5c06b0c4fee.php
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_001F46F6 0_2_001F46F6
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00204362 0_2_00204362
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_0020C4D6 0_2_0020C4D6
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_002046AA 0_2_002046AA
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00216C73 0_2_00216C73
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_0020DD0C 0_2_0020DD0C
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00207F30 0_2_00207F30
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00214FB0 0_2_00214FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 004043D0 appears 316 times
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: String function: 001FDC50 appears 54 times
Source: 7Xex8yR90g.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.evad.winEXE@4/0@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1288:120:WilError_03
Source: 7Xex8yR90g.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 7Xex8yR90g.exe ReversingLabs: Detection: 100%
Source: unknown Process created: C:\Users\user\Desktop\7Xex8yR90g.exe "C:\Users\user\Desktop\7Xex8yR90g.exe"
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: 7Xex8yR90g.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 7Xex8yR90g.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 7Xex8yR90g.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 7Xex8yR90g.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 7Xex8yR90g.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 7Xex8yR90g.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 7Xex8yR90g.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 7Xex8yR90g.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 7Xex8yR90g.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 7Xex8yR90g.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 7Xex8yR90g.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 7Xex8yR90g.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 7Xex8yR90g.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_0041A9AC LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 2_2_0041A9AC
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_001FD416 push ecx; ret 0_2_001FD429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_00418EE5 push ecx; ret 2_2_00418EF8

Malware Analysis System Evasion

barindex
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API coverage: 6.5 %
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_002126FF FindFirstFileExW, 0_2_002126FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_00401120 GetSystemInfo, 2_2_00401120
Source: RegAsm.exe, 00000002.00000002.2009318303.000000000161A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00201A53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00201A53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_0041A9AC LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 2_2_0041A9AC
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_0020EBC0 mov eax, dword ptr fs:[00000030h] 0_2_0020EBC0
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00208A8C mov ecx, dword ptr fs:[00000030h] 0_2_00208A8C
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_0020EC04 mov eax, dword ptr fs:[00000030h] 0_2_0020EC04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_004175D0 mov eax, dword ptr fs:[00000030h] 2_2_004175D0
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_002138E7 GetProcessHeap, 0_2_002138E7
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00201A53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00201A53
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_001FDA85 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_001FDA85
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_001FDBE1 SetUnhandledExceptionFilter, 0_2_001FDBE1
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_001FDC95 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_001FDC95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_0041B5E7 SetUnhandledExceptionFilter, 2_2_0041B5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_0041936E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_0041936E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_00418BFD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00418BFD

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_00E8018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_00E8018D
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41C000 Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 424000 Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 637000 Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1006008 Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_001FD865 cpuid 0_2_001FD865
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: EnumSystemLocalesW, 0_2_0020D0B6
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 0_2_002154FF
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetLocaleInfoW, 0_2_0020D61C
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetLocaleInfoW, 0_2_002156FA
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: EnumSystemLocalesW, 0_2_002157A1
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: EnumSystemLocalesW, 0_2_002157EC
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: EnumSystemLocalesW, 0_2_00215887
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 0_2_00215912
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetLocaleInfoW, 0_2_00215B65
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_00215C8E
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetLocaleInfoW, 0_2_00215D94
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 0_2_00215E63
Source: C:\Users\user\Desktop\7Xex8yR90g.exe Code function: 0_2_001FD06A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime, 0_2_001FD06A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 2_2_00415720 GetUserNameA, 2_2_00415720

Stealing of Sensitive Information

barindex
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.7Xex8yR90g.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2007768798.0000000000229000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2008201264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.7Xex8yR90g.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2007768798.0000000000229000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2008201264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

barindex
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.7Xex8yR90g.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2007768798.0000000000229000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2008201264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.7Xex8yR90g.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2007768798.0000000000229000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2008201264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
No contacted IP infos