Edit tour
Windows
Analysis Report
SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe |
| Analysis ID: | 1491076 |
| MD5: | 4416f8255a013037554c04aad7c0b2d3 |
| SHA1: | 4bd6f215328e380e305a3873298a07921893e18d |
| SHA256: | a798b5783271e848da0af7164c22bc048b122644d60257fbc146a8f98b3cc8b0 |
| Tags: | exe |
| Infos: |  |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Connects to a pastebin service (likely for C&C)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Classification
- System is w10x64
SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe (PID: 6952 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Win64.Troj anX-gen.19 215.24564. exe" MD5: 4416F8255A013037554C04AAD7C0B2D3) 
powershell.exe (PID: 7088 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" /C Get-Ser vice -Name WpnUserSe rvice* | R estart-Ser vice -Forc e MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 7140 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
⊘No Suricata rule has matched
- • AV Detection
- • Compliance
- • Spreading
- • Networking
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
Networking | |
|---|
| Source: | DNS query: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 DLL Side-Loading | 11 Process Injection | 21 Virtualization/Sandbox Evasion | OS Credential Dumping | 1 Query Registry | Remote Services | Data from Local System | 1 Web Service | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 11 Process Injection | LSASS Memory | 1 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 DLL Side-Loading | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | 21 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | Software Packing | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | 3 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 2 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 11 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 55% | Virustotal | Browse | ||
| 45% | ReversingLabs | Win64.Infostealer.Tinba |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 1% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 1% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 8% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| pastebin.com | 104.20.3.235 | true | true |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.20.3.235 | pastebin.com | United States | 13335 | CLOUDFLARENETUS | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1491076 |
| Start date and time: | 2024-08-10 21:29:15 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 58s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 9 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe |
| Detection: | MAL |
| Classification: | mal64.troj.winEXE@4/6@1/1 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, W MIADAP.exe, SIHClient.exe, con host.exe, svchost.exe - Excluded IPs from analysis (wh
itelisted): 23.50.131.216, 23. 50.131.200 - Excluded domains from analysis
(whitelisted): ocsp.digicert. com, slscr.update.microsoft.co m, ctldl.windowsupdate.com.del ivery.microsoft.com, tile-serv ice.weather.microsoft.com, ctl dl.windowsupdate.com, a767.dsp w65.akamai.net, cdn.onenote.ne t, wu-b-net.trafficmanager.net , fe3cr.delivery.mp.microsoft. com, download.windowsupdate.co m.edgesuite.net - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtOpenKeyEx calls foun d. - Report size getting too big, t
oo many NtProtectVirtualMemory calls found. - Report size getting too big, t
oo many NtQueryValueKey calls found. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 15:30:11 | API Interceptor | |
| 15:30:19 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 104.20.3.235 | Get hash | malicious | WSHRAT | Browse |
| |
| Get hash | malicious | WSHRAT | Browse |
| ||
| Get hash | malicious | WSHRAT | Browse |
| ||
| Get hash | malicious | WSHRAT | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| pastebin.com | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DarkTortilla | Browse |
| ||
| Get hash | malicious | DarkTortilla, Neoreklami | Browse |
| ||
| Get hash | malicious | StormKitty, XWorm | Browse |
| ||
| Get hash | malicious | Cryptbot, Neoreklami | Browse |
| ||
| Get hash | malicious | PureLog Stealer, RedLine, Xmrig | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Go Injector, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Go Injector, LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
⊘No context
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 338 |
| Entropy (8bit): | 3.4738726491832703 |
| Encrypted: | false |
| SSDEEP: | 6:kKBDMC8ZJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:lMCdkPlE99SCQl2DUevat |
| MD5: | 25607401FA89E98AF65DC5150CD44861 |
| SHA1: | 0AF557DE53738F64788013ED68790CF0C189C886 |
| SHA-256: | 749058EA6CA79C9E69AB485AD556D6BC12D3B5CBD7FB08731906315E0B3E2C56 |
| SHA-512: | 55E0F3F625121C4500CFC4CD1499E116EE0E45FA303603CB17D24BCCDA505177DE31EFDBA5D3740462DDB6C8CB3EB5BA45A594DA4C20D46F2B9113071B04F66F |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64 |
| Entropy (8bit): | 1.1940658735648508 |
| Encrypted: | false |
| SSDEEP: | 3:NlllulxmH/lZ:NllUg |
| MD5: | D904BDD752B6F23D81E93ECA3BD8E0F3 |
| SHA1: | 026D8B0D0F79861746760B0431AD46BAD2A01676 |
| SHA-256: | B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2 |
| SHA-512: | 5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6221 |
| Entropy (8bit): | 3.734174263270791 |
| Encrypted: | false |
| SSDEEP: | 96:b5DW33CxHmgkvhkvCCtJgnn9bHH5nn98HHd:b5DWyGsinPnq |
| MD5: | 373639A1AA9CBB381B7AF0ECF0864B93 |
| SHA1: | 10075A3A4798CB92D871D9F25A1410093950C48D |
| SHA-256: | B094DA6C4FD48B3633A39A82A70344A75C5E505D47A61F766399A02D658BB46E |
| SHA-512: | C36766CEA0D172C6CEEADB45E96C579447ECC496F5BE34D546303E3AA8326F27CB49677C75B163B20D3D571586B950CFA91A1F823771B4A70941FE02E3545A30 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6221 |
| Entropy (8bit): | 3.734174263270791 |
| Encrypted: | false |
| SSDEEP: | 96:b5DW33CxHmgkvhkvCCtJgnn9bHH5nn98HHd:b5DWyGsinPnq |
| MD5: | 373639A1AA9CBB381B7AF0ECF0864B93 |
| SHA1: | 10075A3A4798CB92D871D9F25A1410093950C48D |
| SHA-256: | B094DA6C4FD48B3633A39A82A70344A75C5E505D47A61F766399A02D658BB46E |
| SHA-512: | C36766CEA0D172C6CEEADB45E96C579447ECC496F5BE34D546303E3AA8326F27CB49677C75B163B20D3D571586B950CFA91A1F823771B4A70941FE02E3545A30 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.741577433067238 |
| TrID: |
|
| File name: | SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe |
| File size: | 1'972'736 bytes |
| MD5: | 4416f8255a013037554c04aad7c0b2d3 |
| SHA1: | 4bd6f215328e380e305a3873298a07921893e18d |
| SHA256: | a798b5783271e848da0af7164c22bc048b122644d60257fbc146a8f98b3cc8b0 |
| SHA512: | c1485ecf554487e60d24b7f5391f962e498ca829499bbec2a136258aa856036dce7dd3c1c3066d1c6ba6945f03e574c72cc17b77d7ec53b0caf34de49025411b |
| SSDEEP: | 49152:GBzMZYKBuAqzxJznMEKV4WFQ0GaXK6KNaRnFRi9Y4RxkcT5aV:GBzzKJFzbRiyYxks5a |
| TLSH: | 3C959F43B35542ECD16AD1B94B66DB13E77238811B21C3CB23E0A2A65FD75F09DBB290 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sc..7.y.7.y.7.y.>z..#.y..w|.&.y...}.=.y...z.1.y...|...y...x.?.y.|zx...y.7.x...y...|.!.y.....6.y...{.6.y.Rich7.y.........PE..d.. |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x140082430 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66A53933 [Sat Jul 27 18:15:15 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 7a9121c1bce825374af94f5121aa08bf |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007FCE7C7CEB68h |
| dec eax |
| add esp, 28h |
| jmp 00007FCE7C7CE72Fh |
| int3 |
| int3 |
| dec eax |
| and dword ptr [ecx+10h], 00000000h |
| dec eax |
| lea eax, dword ptr [00050870h] |
| dec eax |
| mov dword ptr [ecx+08h], eax |
| dec eax |
| lea eax, dword ptr [00043D7Dh] |
| dec eax |
| mov dword ptr [ecx], eax |
| dec eax |
| mov eax, ecx |
| ret |
| int3 |
| int3 |
| dec eax |
| sub esp, 48h |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call 00007FCE7C7CE887h |
| dec eax |
| lea edx, dword ptr [000756BFh] |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call 00007FCE7C806F47h |
| int3 |
| mov eax, 00000001h |
| ret |
| int3 |
| int3 |
| xor eax, eax |
| cmp dword ptr [0014003Ch], eax |
| setne al |
| ret |
| and dword ptr [001588A9h], 00000000h |
| ret |
| dec eax |
| mov dword ptr [esp+08h], ebx |
| push ebp |
| dec eax |
| lea ebp, dword ptr [esp-000004C0h] |
| dec eax |
| sub esp, 000005C0h |
| mov ebx, ecx |
| mov ecx, 00000017h |
| call dword ptr [00042CE6h] |
| test eax, eax |
| je 00007FCE7C7CE8B6h |
| mov ecx, ebx |
| int 29h |
| mov ecx, 00000003h |
| call 00007FCE7C7CE879h |
| xor edx, edx |
| dec eax |
| lea ecx, dword ptr [ebp-10h] |
| inc ecx |
| mov eax, 000004D0h |
| call 00007FCE7C806F09h |
| dec eax |
| lea ecx, dword ptr [ebp-10h] |
| call dword ptr [00042CF1h] |
| dec eax |
| mov ebx, dword ptr [ebp+000000E8h] |
| dec eax |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xf7d28 | 0x1f4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1e6000 | 0x1e8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x1dc000 | 0x9840 | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x1e7000 | 0x1994 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xd6a70 | 0x38 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xd6b00 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xd6930 | 0x140 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0xc5000 | 0xd78 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xc390d | 0xc3a00 | 9ce8eeeb5a5d4afef4bd8b1c5359bfc2 | False | 0.412522464057508 | data | 6.383728084677745 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0xc5000 | 0x374a2 | 0x37600 | b9b7fd80e8f870ae134f195067cd3421 | False | 0.39495450056433407 | data | 5.413691141788401 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xfd000 | 0xde570 | 0xdb000 | b986a565bcd667987e47e969794ae7cc | False | 0.539748100385274 | data | 6.7827754295920695 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x1dc000 | 0x9840 | 0x9a00 | 6d6c1107668bf5b816a3e758b8e90352 | False | 0.47427962662337664 | data | 5.944241416754903 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x1e6000 | 0x1e8 | 0x200 | 7a294975f0bf8ebb5d47cbdbd089ff91 | False | 0.541015625 | data | 4.768131151703051 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x1e7000 | 0x1994 | 0x1a00 | 290fabea703a2c967004f08e76f89903 | False | 0.28846153846153844 | data | 5.421446958010045 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_MANIFEST | 0x1e6060 | 0x188 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5892857142857143 |
| DLL | Import |
|---|---|
| KERNEL32.dll | GetFirmwareType, InitializeCriticalSectionEx, DeleteCriticalSection, FormatMessageA, LocalFree, GetCurrentThread, Sleep, VerifyVersionInfoW, SetFileCompletionNotificationModes, CloseThreadpoolIo, CancelThreadpoolIo, StartThreadpoolIo, CreateThreadpoolIo, GetOverlappedResult, WriteFile, ReadFile, CreateFileW, FormatMessageW, OutputDebugStringW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, ExpandEnvironmentStringsA, GetModuleHandleW, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, SleepConditionVariableSRW, WakeAllConditionVariable, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, InitOnceComplete, InitOnceBeginInitialize, QueryPerformanceFrequency, GetUserDefaultLocaleName, FindClose, LoadLibraryA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, QueryPerformanceCounter, VerSetConditionMask, WideCharToMultiByte, MultiByteToWideChar, FreeLibrary, TerminateProcess, ExitProcess, GetCurrentProcess, WaitForSingleObject, GetLastError, CloseHandle, GlobalFree, GlobalLock, GetFirmwareEnvironmentVariableA, GlobalUnlock, GlobalAlloc, GetCurrentProcessId, GetTickCount64, FindNextFileA, FindFirstFileA, GetFileSizeEx, GetLocaleInfoEx |
| USER32.dll | GetWindowRect, OpenClipboard, LoadIconA, MoveWindow, ShowWindow, RegisterClassExA, DestroyWindow, CreateWindowExW, RegisterClassExW, UnregisterClassW, UnregisterClassA, PostQuitMessage, DefWindowProcA, PeekMessageA, CreateWindowExA, UpdateWindow, SetWindowPos, TranslateMessage, LoadCursorA, CloseClipboard, SetClipboardData, GetClipboardData, EmptyClipboard, TrackMouseEvent, ScreenToClient, GetMessageExtraInfo, GetKeyState, GetCapture, SetCapture, ReleaseCapture, GetSystemMetrics, DispatchMessageA, IsWindowUnicode, GetForegroundWindow, GetClientRect, SetCursorPos, SetCursor, GetCursorPos, ClientToScreen |
| ADVAPI32.dll | GetUserNameW, AdjustTokenPrivileges, LookupPrivilegeValueA, RegCloseKey, RegGetValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, OpenProcessToken |
| SHELL32.dll | ShellExecuteExA |
| MSVCP140.dll | ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z, ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z, ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z, ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z, ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ, ??Bios_base@std@@QEBA_NXZ, ?setf@ios_base@std@@QEAAHHH@Z, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?_Random_device@std@@YAIXZ, ?_Incref@facet@locale@std@@UEAAXXZ, ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, _Mtx_init_in_situ, _Mtx_destroy_in_situ, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?uncaught_exception@std@@YA_NXZ, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?good@ios_base@std@@QEBA_NXZ, ?flags@ios_base@std@@QEBAHXZ, ?width@ios_base@std@@QEBA_JXZ, ??Bid@locale@std@@QEAA_KXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ, ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, _Thrd_detach, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ?_Xinvalid_argument@std@@YAXPEBD@Z, ?fail@ios_base@std@@QEBA_NXZ, ?__ExceptionPtrCreate@@YAXPEAX@Z, ?__ExceptionPtrDestroy@@YAXPEAX@Z, ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z, ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z, ?__ExceptionPtrToBool@@YA_NPEBX@Z, ?__ExceptionPtrCurrentException@@YAXPEAX@Z, ?__ExceptionPtrRethrow@@YAXPEBX@Z, ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z, _Mtx_lock, _Mtx_unlock, _Cnd_init_in_situ, _Cnd_destroy_in_situ, _Cnd_wait, _Cnd_broadcast, ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z, ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z, ?_ReportUnobservedException@details@Concurrency@@YAXXZ, ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ, ?_Xbad_function_call@std@@YAXXZ, ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z, ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ, ?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z, ?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ, ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ, ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ, ??0task_continuation_context@Concurrency@@AEAA@XZ, ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z, ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ, ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ, ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ, ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ, ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ, ?width@ios_base@std@@QEAA_J_J@Z, ?_Xout_of_range@std@@YAXPEBD@Z, ?_Xlength_error@std@@YAXPEBD@Z, ?_Xbad_alloc@std@@YAXXZ, ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z, ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ, ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z, ?_Throw_C_error@std@@YAXH@Z, ?__ExceptionPtrCompare@@YA_NPEBX0@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ, ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ, ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z, ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z, ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z, ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z, ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ, ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ, ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ, ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z, ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z, ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ, ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ, ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z, ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ, ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z, ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ, ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z, ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ, ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ, ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ, ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ, ?classic@locale@std@@SAAEBV12@XZ, ?_Winerror_map@std@@YAHH@Z, ?_Syserror_map@std@@YAPEBDH@Z, ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z |
| CONCRT140.dll | ?_Release@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ, ??0_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ, ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ, ??1_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ |
| IMM32.dll | ImmSetCompositionWindow, ImmGetContext, ImmSetCandidateWindow, ImmReleaseContext |
| D3DCOMPILER_47.dll | D3DCompile |
| CRYPT32.dll | CertGetCertificateChain, CertVerifyCertificateChainPolicy, CertFreeCertificateChain, CertFreeCertificateContext, CryptUnprotectMemory |
| bcrypt.dll | BCryptGetProperty, BCryptCloseAlgorithmProvider, BCryptDestroyHash, BCryptFinishHash, BCryptHashData, BCryptCreateHash, BCryptOpenAlgorithmProvider |
| WINHTTP.dll | WinHttpQueryAuthSchemes, WinHttpReceiveResponse, WinHttpSetCredentials, WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpQueryHeaders, WinHttpAddRequestHeaders, WinHttpOpenRequest, WinHttpSetTimeouts, WinHttpSetOption, WinHttpQueryOption, WinHttpQueryDataAvailable, WinHttpWriteData, WinHttpReadData, WinHttpConnect, WinHttpCloseHandle, WinHttpSendRequest, WinHttpOpen, WinHttpGetDefaultProxyConfiguration, WinHttpSetStatusCallback |
| d3d11.dll | D3D11CreateDeviceAndSwapChain |
| VCRUNTIME140.dll | __std_exception_destroy, _CxxThrowException, __current_exception_context, __std_exception_copy, memmove, __current_exception, __C_specific_handler, _purecall, strstr, memset, memchr, memcpy, memcmp, __std_terminate |
| VCRUNTIME140_1.dll | __CxxFrameHandler4 |
| api-ms-win-crt-runtime-l1-1-0.dll | _cexit, _crt_atexit, _seh_filter_exe, _register_onexit_function, _initialize_onexit_table, _initialize_narrow_environment, _set_app_type, _configure_narrow_argv, abort, _invalid_parameter_noinfo_noreturn, _get_narrow_winmain_command_line, _initterm, _initterm_e, exit, _exit, _c_exit, _register_thread_local_exe_atexit_callback, _beginthreadex, terminate, _errno |
| api-ms-win-crt-string-l1-1-0.dll | strcmp, strncmp, isdigit, isalpha, isxdigit, strcpy_s, strcat_s, strncpy |
| api-ms-win-crt-stdio-l1-1-0.dll | fseek, _wfopen, __stdio_common_vsprintf, __stdio_common_vsprintf_s, __stdio_common_vsscanf, ftell, __stdio_common_vfprintf, ungetc, setvbuf, _fseeki64, fsetpos, fread, fputc, fgetpos, fgetc, fflush, _get_stream_buffer_pointers, __p__commode, _set_fmode, fwrite, __acrt_iob_func, feof, ferror, fclose |
| api-ms-win-crt-heap-l1-1-0.dll | malloc, free, realloc, _callnewh, _set_new_mode |
| api-ms-win-crt-convert-l1-1-0.dll | atoi, wcstol, wcstombs_s |
| api-ms-win-crt-filesystem-l1-1-0.dll | _mkdir, _access_s, remove, _lock_file, _unlock_file |
| api-ms-win-crt-time-l1-1-0.dll | _time64, strftime, _localtime64, _localtime64_s |
| api-ms-win-crt-math-l1-1-0.dll | sqrtf, cosf, fmodf, ceilf, sinf, acosf, __setusermatherr |
| api-ms-win-crt-utility-l1-1-0.dll | qsort |
| api-ms-win-crt-locale-l1-1-0.dll | _configthreadlocale |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
- Total Packets: 20
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 10, 2024 21:30:15.721026897 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:15.721096992 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:15.721189022 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:15.742516994 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:15.742531061 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:17.346626043 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:17.346733093 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:17.349314928 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:17.349328995 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:17.349728107 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:17.400803089 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.045200109 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.088496923 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.589457989 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.589607954 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.589694023 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.589694023 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.589728117 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.589780092 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.589795113 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.596093893 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.596163034 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.596183062 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.604679108 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.604747057 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.604779005 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.622872114 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.622941971 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.622967958 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.666461945 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.711827040 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.760332108 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.781188011 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.785739899 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.785810947 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.785831928 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.793498993 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.793658972 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.793668032 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.793725014 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.793783903 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.794538975 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.794559002 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Aug 10, 2024 21:30:19.794579983 CEST | 49731 | 443 | 192.168.2.4 | 104.20.3.235 |
| Aug 10, 2024 21:30:19.794588089 CEST | 443 | 49731 | 104.20.3.235 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 10, 2024 21:30:15.466074944 CEST | 61176 | 53 | 192.168.2.4 | 1.1.1.1 |
| Aug 10, 2024 21:30:15.604515076 CEST | 53 | 61176 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Aug 10, 2024 21:30:15.466074944 CEST | 192.168.2.4 | 1.1.1.1 | 0xdd9 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Aug 10, 2024 21:30:15.604515076 CEST | 1.1.1.1 | 192.168.2.4 | 0xdd9 | No error (0) | 104.20.3.235 | A (IP address) | IN (0x0001) | false | ||
| Aug 10, 2024 21:30:15.604515076 CEST | 1.1.1.1 | 192.168.2.4 | 0xdd9 | No error (0) | 172.67.19.24 | A (IP address) | IN (0x0001) | false | ||
| Aug 10, 2024 21:30:15.604515076 CEST | 1.1.1.1 | 192.168.2.4 | 0xdd9 | No error (0) | 104.20.4.235 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49731 | 104.20.3.235 | 443 | 6952 | C:\Users\user\Desktop\SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-10 19:30:19 UTC | 102 | OUT | |
| 2024-08-10 19:30:19 UTC | 530 | IN | |
| 2024-08-10 19:30:19 UTC | 839 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN | |
| 2024-08-10 19:30:19 UTC | 1369 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 15:30:08 |
| Start date: | 10/08/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Win64.TrojanX-gen.19215.24564.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff63b140000 |
| File size: | 1'972'736 bytes |
| MD5 hash: | 4416F8255A013037554C04AAD7C0B2D3 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 15:30:08 |
| Start date: | 10/08/2024 |
| Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff788560000 |
| File size: | 452'608 bytes |
| MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 15:30:08 |
| Start date: | 10/08/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly
