Windows Analysis Report
Insanity Loader.exe

Overview

General Information

Sample name: Insanity Loader.exe
Analysis ID: 1507525
MD5: 3fd87bf20a6572f497fd8707d6a48dc8
SHA1: b87ea66e5642608ba518b1eba1f8d7965747bb1b
SHA256: 91e1004b69d539f58774601b050151fb6fb706e03b5f65aa6288a586048e9563
Tags: exe
Infos:

Detection

RedLine
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Yara detected RedLine Stealer
.NET source code contains very large array initializations
AI detected suspicious sample
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Detected potential crypto function
Enables debug privileges
Enables security privileges
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection

barindex
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Source: Insanity Loader.exe Joe Sandbox ML: detected
Source: Insanity Loader.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: _.pdb source: Insanity Loader.exe, 00000000.00000002.2041056918.00000000021F7000.00000004.00000020.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000003.2028306043.000000000067B000.00000004.00000020.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000002.2044454481.0000000003521000.00000004.00000800.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000002.2044602082.0000000004B10000.00000004.08000000.00040000.00000000.sdmp
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,]q equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.s
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002795000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_f261fa75-7

System Summary

barindex
Source: Insanity Loader.exe, type: SAMPLE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00408C60 0_2_00408C60
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0040DC11 0_2_0040DC11
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00407C3F 0_2_00407C3F
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00418CCC 0_2_00418CCC
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00406CA0 0_2_00406CA0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004028B0 0_2_004028B0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0041A4BE 0_2_0041A4BE
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00418244 0_2_00418244
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00401650 0_2_00401650
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00402F20 0_2_00402F20
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004193C4 0_2_004193C4
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00418788 0_2_00418788
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00402F89 0_2_00402F89
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00402B90 0_2_00402B90
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004073A0 0_2_004073A0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0215E17C 0_2_0215E17C
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_02152ECC 0_2_02152ECC
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_053A1638 0_2_053A1638
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_053A01D8 0_2_053A01D8
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_053A01C8 0_2_053A01C8
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_054ED3B0 0_2_054ED3B0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_054ECE88 0_2_054ECE88
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_056B04D0 0_2_056B04D0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_056B6C18 0_2_056B6C18
Source: C:\Users\user\Desktop\Insanity Loader.exe Process token adjusted: Security Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: String function: 0040E1D8 appears 44 times
Source: Insanity Loader.exe, 00000000.00000003.2028040085.00000000006FD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2041056918.00000000021F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2041056918.00000000021F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000003.2028108861.0000000000711000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000003.2028306043.000000000067B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000003.2028306043.000000000067B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044966965.0000000005230000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044454481.0000000003521000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044454481.0000000003521000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044602082.0000000004B10000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044602082.0000000004B10000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Insanity Loader.exe, type: SAMPLE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, HWiM5nizdBqTYpoFw7P.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal72.troj.evad.winEXE@2/1@0/0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: C:\Users\user\Desktop\Insanity Loader.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Insanity Loader.exe.log Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4180:120:WilError_03
Source: C:\Users\user\Desktop\Insanity Loader.exe Command line argument: 08A 0_2_00413780
Source: Insanity Loader.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Insanity Loader.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Insanity Loader.exe "C:\Users\user\Desktop\Insanity Loader.exe"
Source: C:\Users\user\Desktop\Insanity Loader.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Insanity Loader.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: _.pdb source: Insanity Loader.exe, 00000000.00000002.2041056918.00000000021F7000.00000004.00000020.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000003.2028306043.000000000067B000.00000004.00000020.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000002.2044454481.0000000003521000.00000004.00000800.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000002.2044602082.0000000004B10000.00000004.08000000.00040000.00000000.sdmp
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: Insanity Loader.exe Static PE information: real checksum: 0x23bfb should be: 0x883eb
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0040E21D push ecx; ret 0_2_0040E230
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_053A8438 push esp; retf 0_2_053A8481
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_053A9A60 push esp; iretd 0_2_053A9A61
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_056B900D push FFFFFF8Bh; iretd 0_2_056B900F
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, eYHragi8ZCpLS1lWPwX.cs High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, HMcqtE6J6r1oToPnxPf.cs High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, qqaOQ7MORaiyuX290kx.cs High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, eYHragi8ZCpLS1lWPwX.cs High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, HMcqtE6J6r1oToPnxPf.cs High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, qqaOQ7MORaiyuX290kx.cs High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, eYHragi8ZCpLS1lWPwX.cs High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, HMcqtE6J6r1oToPnxPf.cs High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, qqaOQ7MORaiyuX290kx.cs High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, eYHragi8ZCpLS1lWPwX.cs High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, HMcqtE6J6r1oToPnxPf.cs High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, qqaOQ7MORaiyuX290kx.cs High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, eYHragi8ZCpLS1lWPwX.cs High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, HMcqtE6J6r1oToPnxPf.cs High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, qqaOQ7MORaiyuX290kx.cs High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE@\]Q
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE`,]Q
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE
Source: C:\Users\user\Desktop\Insanity Loader.exe Memory allocated: 2150000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Memory allocated: 2520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Memory allocated: 4520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: C:\Users\user\Desktop\Insanity Loader.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\Insanity Loader.exe TID: 3572 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe`,]q
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe@\]q
Source: C:\Users\user\Desktop\Insanity Loader.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0040CE09
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree, 0_2_0040ADB0
Source: C:\Users\user\Desktop\Insanity Loader.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0040CE09
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0040E61C
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00416F6A
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_004123F1 SetUnhandledExceptionFilter, 0_2_004123F1
Source: C:\Users\user\Desktop\Insanity Loader.exe Memory allocated: page read and write | page guard Jump to behavior
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002795000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetProgmanWindow
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002795000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SetProgmanWindow
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: GetLocaleInfoA, 0_2_00417A20
Source: C:\Users\user\Desktop\Insanity Loader.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_00412A15
Source: C:\Users\user\Desktop\Insanity Loader.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: Process Memory Space: Insanity Loader.exe PID: 5664, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara match File source: Process Memory Space: Insanity Loader.exe PID: 5664, type: MEMORYSTR
No contacted IP infos