Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1511209
MD5:	c0feb087f1cfa85fdb001e059f4c95c7
SHA1:	1d9ab2eb37f85bea36f3e6ded442154181c96964
SHA256:	38957fb3708884f1a8befb0c17b0fa81f57005a5de058772cc12bf357c548eab
Tags:	exe
Infos:

Detection

44Caliber Stealer, BlackGuard, Rags Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected 44Caliber Stealer

Yara detected BlackGuard

Yara detected Rags Stealer

AI detected suspicious sample

Contains functionality to capture screen (.Net source)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Loader.exe (PID: 1732 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: C0FEB087F1CFA85FDB001E059F4C95C7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
BlackGuard	According to Zscaler, BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP credentials, saved browser credentials, and email clients.	No Attribution	https://blog.cyble.com/2022/04/01/dissecting-blackguard-info-stealer/ https://blogs.blackberry.com/en/2022/04/threat-thursday-blackguard-infostealer https://cyberint.com/blog/research/blackguard-stealer/ https://ke-la.com/information-stealers-a-new-landscape/ https://medium.com/s2wblog/rising-stealer-in-q1-2022-blackguard-stealer-f516d9f85ee5	https://malpedia.caad.fkie.fraunhofer.de/details/win.blackguard

Malware Configuration

Threatname: 44Caliber Stealer

{"Discord Webhook": "https://discord.com/api/webhooks/1280107935317495880/Q8mmvXU6Bc1Q-R-2e0aAMsbedaMqyt0txCOBc8XSsTRNeUIepUtoX2DE4a6MxP9SzEFB\u0001Scam1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Loader.exe	JoeSecurity_BlackGuard	Yara detected BlackGuard	Joe Security
Loader.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Loader.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Loader.exe	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Loader.exe	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
Loader.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a821:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Loader.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x3bef5:$s1: \VPN\NordVPN 0x3bf99:$s1: \VPN\NordVPN 0x3c02f:$s2: \VPN\OpenVPN 0x3c09d:$s3: \VPN\ProtonVPN
Loader.exe	MALWARE_Win_A310Logger	Detects A310Logger	ditekSHen	0x3d7a1:$s11: \Ethereum\keystore 0x3a7aa:$v1_5: sharedSecret 0x3c8c3:$v1_6: ":"([^"]+)" 0x328d2:$v1_8: WritePasswords 0x33093:$v1_9: sGeckoBrowserPaths 0x2e555:$v1_10: get_sPassword
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1737602637.000001FD8829E000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xc4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x7fc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_BlackGuard	Yara detected BlackGuard	Joe Security
00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a621:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.1737602637.000001FD881F7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Process Memory Space: Loader.exe PID: 1732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 1732	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Process Memory Space: Loader.exe PID: 1732	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
Process Memory Space: Loader.exe PID: 1732	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1504a:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x4b5bb:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x4b6a6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Loader.exe.1fd86360000.0.unpack	JoeSecurity_BlackGuard	Yara detected BlackGuard	Joe Security
0.0.Loader.exe.1fd86360000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Loader.exe.1fd86360000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Loader.exe.1fd86360000.0.unpack	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
0.0.Loader.exe.1fd86360000.0.unpack	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
0.0.Loader.exe.1fd86360000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a821:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.0.Loader.exe.1fd86360000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x3bef5:$s1: \VPN\NordVPN 0x3bf99:$s1: \VPN\NordVPN 0x3c02f:$s2: \VPN\OpenVPN 0x3c09d:$s3: \VPN\ProtonVPN
0.0.Loader.exe.1fd86360000.0.unpack	MALWARE_Win_A310Logger	Detects A310Logger	ditekSHen	0x3d7a1:$s11: \Ethereum\keystore 0x3a7aa:$v1_5: sharedSecret 0x3c8c3:$v1_6: ":"([^"]+)" 0x328d2:$v1_8: WritePasswords 0x33093:$v1_9: sGeckoBrowserPaths 0x2e555:$v1_10: get_sPassword
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Loader.exe

Avira: detected

Found malware configuration

Source: 0.0.Loader.exe.1fd86360000.0.unpack

Malware Configuration Extractor: 44Caliber Stealer {"Discord Webhook": "https://discord.com/api/webhooks/1280107935317495880/Q8mmvXU6Bc1Q-R-2e0aAMsbedaMqyt0txCOBc8XSsTRNeUIepUtoX2DE4a6MxP9SzEFB\u0001Scam1"}

Multi AV Scanner detection for submitted file

Source: Loader.exe	Virustotal: Detection: 78%			Perma Link
Source: Loader.exe	ReversingLabs: Detection: 78%

Yara detected BlackGuard

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: freegeoip.app

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.189:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: Loader.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: Loader.exe, 00000000.00000002.1737602637.000001FD881C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: Loader.exe, 00000000.00000002.1737602637.000001FD882FD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \44CALIBER\obj\Release\Insidious.pdb source: Loader.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb5 source: Loader.exe, 00000000.00000002.1742501745.000001FDA089A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: Loader.exe, 00000000.00000002.1737602637.000001FD882FD000.00000004.00000800.00020000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 104.21.85.189 104.21.85.189

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: freegeoip.app
Source: global traffic	DNS traffic detected: DNS query: ipbase.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 14 Sep 2024 10:39:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAge: 10899Cache-Control: public,max-age=0,must-revalidateCache-Status: "Netlify Edge"; hitVary: Accept-EncodingX-Nf-Request-Id: 01J7R1TPV31H16NKRFQCHVFQ90CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5XuBdYnjcdt7DU%2FpomCHXBqMINcKqwIyis2qQ8xm5Zm0SDCbto%2BOdbVSZkkfUdt4WTiZwkFWq75e4lJpZnZL%2B5pvjgJlLSwVFKhoEWm83olY5nT6uOZzDwk%2Bk7GJ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c2fc0321f1b8c57-EWRalt-svc: h3=":443"; ma=86400

Source: cert9.db.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.0.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cert9.db.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.0.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Loader.exe, 00000000.00000002.1737602637.000001FD8820D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://freegeoip.app
Source: Loader.exe, 00000000.00000002.1737602637.000001FD8827D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipbase.com
Source: cert9.db.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.0.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Loader.exe, 00000000.00000002.1737602637.000001FD883B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cert9.db.0.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.0.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Loader.exe, 00000000.00000002.1737602637.000001FD8825E000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.1737602637.000001FD882FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: Loader.exe, 00000000.00000002.1737602637.000001FD881C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.vimeworld.ru/user/name/
Source: Loader.exe	String found in binary or memory: https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Loader.exe	String found in binary or memory: https://discord.com/api/webhooks/1280107935317495880/Q8mmvXU6Bc1Q-R-2e0aAMsbedaMqyt0txCOBc8XSsTRNeUI
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Loader.exe, 00000000.00000002.1737602637.000001FD882FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: Loader.exe, 00000000.00000002.1737602637.000001FD881C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app
Source: Loader.exe, 00000000.00000002.1737602637.000001FD881C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: Loader.exe, 00000000.00000002.1737602637.000001FD88266000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com
Source: Loader.exe, 00000000.00000002.1737602637.000001FD88262000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.1737602637.000001FD88266000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.1737602637.000001FD8820D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com/xml/
Source: Loader.exe	String found in binary or memory: https://steamcommunity.com/profiles/ASOFTWARE
Source: tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Loader.exe, 00000000.00000002.1741476843.000001FD9826B000.00000004.00000800.00020000.00000000.sdmp, tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loader.exe, 00000000.00000002.1741476843.000001FD9826B000.00000004.00000800.00020000.00000000.sdmp, tmp8681.tmp.tmpdb.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.189:443 -> 192.168.2.4:49731 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: Loader.exe, Screen.cs

.Net Code: GetScreen

E-Banking Fraud

Yara detected BlackGuard

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: Loader.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Loader.exe, type: SAMPLE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: Loader.exe, type: SAMPLE	Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE	Matched rule: Detects A310Logger Author: ditekSHen
Source: 00000000.00000002.1737602637.000001FD8829E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: Loader.exe PID: 1732, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7D4726	0_2_00007FFD9B7D4726
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C1488	0_2_00007FFD9B7C1488
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7D54D2	0_2_00007FFD9B7D54D2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C1448	0_2_00007FFD9B7C1448
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C13D3	0_2_00007FFD9B7C13D3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C573D	0_2_00007FFD9B7C573D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C14A0	0_2_00007FFD9B7C14A0

Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInsidious.exe6 vs Loader.exe
Source: Loader.exe	Binary or memory string: OriginalFilenameInsidious.exe6 vs Loader.exe

Source: Loader.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Loader.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: Loader.exe, type: SAMPLE	Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 00000000.00000002.1737602637.000001FD8829E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: Loader.exe PID: 1732, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: Loader.exe, Help.cs

Suspicious URL: 'https://api.vimeworld.ru/user/name/'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/14@2/2

Source: C:\Users\user\Desktop\Loader.exe

File created: C:\Users\Public\fqs92o4p.default-release

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Loader.exe

File created: C:\Users\user\AppData\Local\Temp\tmp8681.tmp

Jump to behavior

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Loader.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Loader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\Loader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp871F.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Loader.exe	Virustotal: Detection: 78%
Source: Loader.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\Loader.exe

File read: C:\Users\user\Desktop\Loader.exe

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: Loader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Loader.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Loader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdb source: Loader.exe, 00000000.00000002.1737602637.000001FD881C1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: Loader.exe, 00000000.00000002.1737602637.000001FD882FD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \44CALIBER\obj\Release\Insidious.pdb source: Loader.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb5 source: Loader.exe, 00000000.00000002.1742501745.000001FDA089A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: Loader.exe, 00000000.00000002.1737602637.000001FD882FD000.00000004.00000800.00020000.00000000.sdmp

Source: Loader.exe

Static PE information: 0xC5F44CBF [Fri Mar 29 21:53:03 2075 UTC]

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C1488 push esp; retn 4810h	0_2_00007FFD9B7C16C6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C021D push E95DBA98h; ret	0_2_00007FFD9B7C0259
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C6105 pushad ; ret	0_2_00007FFD9B7C61CD
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C00BD pushad ; iretd	0_2_00007FFD9B7C00C1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C9D9A push eax; ret	0_2_00007FFD9B7C9E7D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00007FFD9B7C9D10 push eax; ret	0_2_00007FFD9B7C9E7D

Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Loader.exe	Memory allocated: 1FD866D0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory allocated: 1FDA01C0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599527	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599289	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Window / User API: threadDelayed 2902

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1260	Thread sleep count: 277 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1260	Thread sleep count: 2902 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599527s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599289s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -599031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1272	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 5700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\Loader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\Desktop\Loader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599527	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599289	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Loader.exe, 00000000.00000002.1742501745.000001FDA089A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Loader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Queries volume information: C:\Users\user\Desktop\Loader.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected 44Caliber Stealer

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 1732, type: MEMORYSTR

Yara detected BlackGuard

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Rags Stealer

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1737602637.000001FD881F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 1732, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum
Source: Loader.exe, 00000000.00000002.1737602637.000001FD88337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: JaxxDir
Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: ExodusDir
Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum
Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: Loader.exe, 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 1732, type: MEMORYSTR

Remote Access Functionality

Yara detected 44Caliber Stealer

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 1732, type: MEMORYSTR

Yara detected BlackGuard

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Rags Stealer

Source: Yara match	File source: Loader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Loader.exe.1fd86360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1737602637.000001FD881F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 1732, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Loader.exe	79%	Virustotal		Browse
Loader.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.A310Logger
Loader.exe	100%	Avira	HEUR/AGEN.1307065
Loader.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
ipbase.com	0%	Virustotal		Browse
freegeoip.app	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/ASOFTWARE	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1280107935317495880/Q8mmvXU6Bc1Q-R-2e0aAMsbedaMqyt0txCOBc8XSsTRNeUI	0%	Avira URL Cloud	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	Avira URL Cloud	safe
https://freegeoip.app	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://freegeoip.app	0%	Virustotal		Browse
http://ipbase.com	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1280107935317495880/Q8mmvXU6Bc1Q-R-2e0aAMsbedaMqyt0txCOBc8XSsTRNeUI	0%	Virustotal		Browse
http://x1.c.lencr.org/0	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/0	0%	Avira URL Cloud	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/	1%	Virustotal		Browse
http://ipbase.com	0%	Virustotal		Browse
http://x1.c.lencr.org/0	0%	Virustotal		Browse
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	Virustotal		Browse
https://ipbase.com/xml/	0%	Avira URL Cloud	safe
https://api.vimeworld.ru/user/name/	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/0	0%	Virustotal		Browse
https://steamcommunity.com/profiles/ASOFTWARE	0%	Virustotal		Browse
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Virustotal		Browse
https://ipbase.com	0%	Avira URL Cloud	safe
https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/	0%	Avira URL Cloud	safe
http://freegeoip.app	0%	Avira URL Cloud	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	Virustotal		Browse
https://api.vimeworld.ru/user/name/	0%	Virustotal		Browse
https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/	0%	Virustotal		Browse
http://freegeoip.app	0%	Virustotal		Browse
https://ipbase.com/xml/	0%	Virustotal		Browse
https://ipbase.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipbase.com	104.21.85.189	true	false	0%, Virustotal, Browse	unknown
freegeoip.app	188.114.97.3	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://freegeoip.app/xml/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipbase.com/xml/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	tmp8681.tmp.tmpdb.0.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/ASOFTWARE	Loader.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://discord.com/api/webhooks/1280107935317495880/Q8mmvXU6Bc1Q-R-2e0aAMsbedaMqyt0txCOBc8XSsTRNeUI	Loader.exe	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://freegeoip.app	Loader.exe, 00000000.00000002.1737602637.000001FD881C1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	cert9.db.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	cert9.db.0.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp8681.tmp.tmpdb.0.dr	false	URL Reputation: safe	unknown
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	Loader.exe, 00000000.00000002.1737602637.000001FD8825E000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.1737602637.000001FD882FD000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe	unknown
http://ipbase.com	Loader.exe, 00000000.00000002.1737602637.000001FD8827D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	cert9.db.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/0	cert9.db.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	cert9.db.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.vimeworld.ru/user/name/	Loader.exe, 00000000.00000002.1737602637.000001FD881C1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/	Loader.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org	tmp8681.tmp.tmpdb.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Loader.exe, 00000000.00000002.1737602637.000001FD883B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loader.exe, 00000000.00000002.1741476843.000001FD98249000.00000004.00000800.00020000.00000000.sdmp, tmp86A1.tmp.dat.0.dr, tmp8730.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://ipbase.com	Loader.exe, 00000000.00000002.1737602637.000001FD88266000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://freegeoip.app	Loader.exe, 00000000.00000002.1737602637.000001FD8820D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	freegeoip.app	European Union		13335	CLOUDFLARENETUS	true
104.21.85.189	ipbase.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511209
Start date and time:	2024-09-14 12:38:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/14@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 7 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:38:59	API Interceptor	18x Sleep call for process: Loader.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	infofunctionboard.autos/check-online
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/link.sbstck.com/redirect/9f1a559b-1924-42a1-ac63-d801d0b621e3?j=eyJ1IjoiNGQydGxqIn0.nUqvCKS4pzEN7oIgjX67rfaG_zpqbsbEevJ7SYpXFUg	Get hash	malicious	HTMLPhisher	Browse	link.sbstck.com/redirect/9f1a559b-1924-42a1-ac63-d801d0b621e3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/lPrdr8CZ/download
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	http://aivx.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	aivx.pages.dev/favicon.ico
	Comprobante.PDF867564575869708776565434576897.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sweetwhore/five/fre.php
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/altr/
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/kslt/
	SecuriteInfo.com.FileRepMalware.20092.26363.exe	Get hash	malicious	Unknown	Browse	13213edsewrwrfw.okis.ru/
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/bm51/
104.21.85.189	Nursultan.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Blank Grabber, Rags Stealer, Umbral Stealer, XWorm	Browse
	Pots.exe	Get hash	malicious	44userber Stealer, Rags Stealer	Browse
	aurora-live-20240221.exe	Get hash	malicious	Unknown	Browse
	dudick SystemDesk Important Crediential Notification 1.eml	Get hash	malicious	HTMLPhisher	Browse
	64drop.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse
	123.scr.exe	Get hash	malicious	Unknown	Browse
	RP.sfx.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse
	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse
	rvYr7FRwkG.dll	Get hash	malicious	Unknown	Browse
	case (426).xls	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
freegeoip.app	Nursultan.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Blank Grabber, Rags Stealer, Umbral Stealer, XWorm	Browse	188.114.97.3
	External.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	188.114.96.3
	Insidious_protected.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	188.114.96.3
	nyen2eabmfb.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	188.114.97.3
	Cheat.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	188.114.97.3
	B5U2ccQ8H1.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	188.114.97.3
	xj40xovMsm.exe	Get hash	malicious	AsyncRAT, AveMaria, Keyzetsu Clipper, MicroClip, PureLog Stealer, RL STEALER, RedLine	Browse	188.114.96.3
	Pots.exe	Get hash	malicious	44userber Stealer, Rags Stealer	Browse	104.21.73.97
	qdHMT36Tn9.exe	Get hash	malicious	44Caliber Stealer, Njrat, Rags Stealer	Browse	172.67.160.84
	64drop.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.73.97
ipbase.com	Nursultan.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Blank Grabber, Rags Stealer, Umbral Stealer, XWorm	Browse	104.21.85.189
	External.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	172.67.209.71
	xj40xovMsm.exe	Get hash	malicious	AsyncRAT, AveMaria, Keyzetsu Clipper, MicroClip, PureLog Stealer, RL STEALER, RedLine	Browse	172.67.209.71
	Pots.exe	Get hash	malicious	44userber Stealer, Rags Stealer	Browse	104.21.85.189
	qdHMT36Tn9.exe	Get hash	malicious	44Caliber Stealer, Njrat, Rags Stealer	Browse	172.67.209.71
	64drop.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.85.189
	123.scr.exe	Get hash	malicious	Unknown	Browse	104.21.85.189
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.209.71
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.209.71
	RP.sfx.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.85.189

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33
	app__v6.20.5_.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	WorldWars Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%7A%6F%71%7A%71%2E%6F%72%67%2F%61%74%74%2F%61%74%74%2FLZH2gvcseOdSTVo1rdoVRIuO/amZhbGNrZUBraWxjb3lnbG9iYWxmb29kcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226
CLOUDFLARENETUS	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33
	app__v6.20.5_.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	WorldWars Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%7A%6F%71%7A%71%2E%6F%72%67%2F%61%74%74%2F%61%74%74%2FLZH2gvcseOdSTVo1rdoVRIuO/amZhbGNrZUBraWxjb3lnbG9iYWxmb29kcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	188.114.97.3 104.21.85.189
	WIN CHANGER 2.3.exe	Get hash	malicious	XWorm	Browse	188.114.97.3 104.21.85.189
	client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	188.114.97.3 104.21.85.189
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%7A%6F%71%7A%71%2E%6F%72%67%2F%61%74%74%2F%61%74%74%2FLZH2gvcseOdSTVo1rdoVRIuO/amZhbGNrZUBraWxjb3lnbG9iYWxmb29kcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3 104.21.85.189
	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 104.21.85.189
	https://procoinbaselogin.iwopop.com/	Get hash	malicious	Unknown	Browse	188.114.97.3 104.21.85.189
	http://hamouda0-t3-zabi.blogspot.com.es/	Get hash	malicious	Unknown	Browse	188.114.97.3 104.21.85.189
	http://metasamsk-uswallt.gitbook.io/	Get hash	malicious	Unknown	Browse	188.114.97.3 104.21.85.189
	http://bafybeieubbdk6tipjqxnm5i6qkoynxds3ers6m3oohr525ku4i4s5ccmz4.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	188.114.97.3 104.21.85.189
	https://ranjitkumarmehta1.github.io/netflix/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3 104.21.85.189

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.078627837804452
Encrypted:	false
SSDEEP:	6:pYcCFWl4BjJUVcVIKwvkWQwSTelCpEu63rZu0Ghwa1B7VXatA67X:pYzdgWgXSTeMpa3lV2wUB7VKtA6r
MD5:	A1C7C9118629F6C0825080AF4BE13B97
SHA1:	31C6EE166D629F1B861D85A03620084C70B585F7
SHA-256:	62C3F5BD94A2B2DA9925E5A4A8AFCBD9B9C4EA3921AAF8A600239F4C5E1CB571
SHA-512:	D546F95790A2A30945905BEB3A025FB697E8904D4973AC1760315F4E50BFFEB2320CEE5DE2F0041945C3E665981290247075AD6EEDABD7D17276EED8096001E8
Malicious:	false
Reputation:	low
Preview:	==================================================. Operating system: Windows 10 Pro (64 Bit). PC user: 123716/user. ClipBoard: . Launch: C:\Users\user\Desktop\Loader.exe. ==================================================. Screen resolution: 1280x1024. Current time: 14/09/2024 09:08:47. HWID: 2B52705BB8. ==================================================. CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz. RAM: 4094MB. GPU: PFD5UB1AY. ==================================================. IP Geolocation: Fail Fail. Log Date: 09/14/2024 6:38. BSSID: 00:50:56:a7:21:15. ==================================================

C:\ProgramData\44\Process.txt

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4117
Entropy (8bit):	4.712395617489676
Encrypted:	false
SSDEEP:	96:rRljjDjO0jw7LrbzrSjtoghHjEjjjjjRHt2jLjjRSVjbmgfbrjjRRRjjtkrujjju:kfzOOtDZ0Z7
MD5:	C398165130B10525EEBE9DD718244C38
SHA1:	36C53CD289E8AA1A9AA4EF22629CAD5E893084D6
SHA-256:	97B9545406DD5D618A00B2D3FE9C4CAFDF3D1CCB4328C84C699571449ED57CB2
SHA-512:	BE5C4C4A203748D9B0EA9F5804D8891C389F3C923ECCB2B4C62FC82ACF66FD87337D836AF48104837FDC163DBD0A3AA7D000E4C34844E44E1D8358B587521536
Malicious:	false
Reputation:	low
Preview:	NAME: qmyOKsemoVLVrQbNhKnKA..NAME: svchost..NAME: svchost..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: explorer..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: fontdrvhost..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: smartscreen..NAME: svchost..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: csrss..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: svchost..NAME: sihost..NAME: OfficeClickToRun..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: svchost..NAME: svchost..NAME: dasHost..NAME: svchost..NAME: ctfmon..NAME: RuntimeBroker..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: RuntimeBroker..NAME: RuntimeBroker..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: svchost..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: smss..NAME: svchost..NAME: svchost..NAME: WmiPrvSE..NAME: svchost..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: Loader..NAME: svchost..NAME: qmyOKsemoVLVrQbNhKnKA..NAME: dllhost..NAME: svchost..NAME: svchost..NAME: RuntimeBroker..NAME: StartMenuExperie

C:\ProgramData\44\Screen.png

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	692300
Entropy (8bit):	7.925039649975553
Encrypted:	false
SSDEEP:	12288:xy+SdWiSg3w5b4t/oLZPeUWS30E28u7xPD521l+1eVsg6cZR20o03cI4deRrG25h:U+SdhSlBKqVNWSkPJD52P6ho20oycIn9
MD5:	C75ADF952FCD79F2AB2278123A958EB9
SHA1:	AD5ABAC45F599CE014A66EFE1992BE2578FB2083
SHA-256:	AB895FE9DA31127000CA9A19E676A150CB85180896609AA3FFD770099C739205
SHA-512:	B569F2C40096964BD3842D1666E40900E4A83C31CE09C840FF87C2794A155413CECB2F3C5D474A02FCDDF6ADC5E261E48FFC37C8EDABF1FA5930BB1EE9D4A7ED
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..g.mWy...]'.w.{..../..{.\.o'....rj.$.3JH ..D...l0..0&.$...l....P....."..D2....\....w.]U.H..1.1.\|.;.Z{Wa.<.k.Fg}..X.3.oO..YZ......w.....&kf.W.g...{..~k)..D....6...gd.5.._}G7z.7+.m..;/.W..._~c],."g.._.7..k...._]../...d.....^.v./..,..g...'...hF/..Xx.....m.....y_^..............s..0..[...Y....Y.v....2..e&.O..~...V.\.[.z..\|n~...51~..O...'.....j&[....=O(..[..._....q.......r_.]x.'f...9...xe.#{...%....OT.....1.O...X.xK`..7-...'ly.M.......C..=..n......!7T..\|}m..9...om.V.1{.O...=.p..v._.[J.5.e~.=[O+.......;...^Sq..k'......~j..AWw[.xU..l/...zM.m..5....SJ.,N..}....IWu....F'\Q..?..[.9..i..rm....(.6b%.v;y.?:.:.xK.g\|....r=.....+.m'.}..o9...wye\|..&..'_..x@..c.........^.....[._..K+..........a...Z.......+[./.-....Q>.........:6.....e.c>Ra..-..?..../.yqe.Q..cr.S.r.%.6...e.#....p.p.....r..b.C/...9....o.{..v.e..e......V.....rh.n..3O.3...<.\|.%....w~7>..7

C:\Users\Public\fqs92o4p.default-release\cert9.db

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 7, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.64343788909108
Encrypted:	false
SSDEEP:	384:A1zkVmvQhyn+Zoz67dNlIMMz333JGN8j/LKXYj5kuv:AUUMXCyIr
MD5:	B6787B79D64948AAC1D6359AC18AB268
SHA1:	0831EB15AB2B330BE95975A24F8945ED284D0BA4
SHA-256:	9D6FD3B8AB8AA7934C75EDE36CEB9CF4DDAD06C5031E89872B4E814D7DB674E2
SHA-512:	9296866380EF966F1CB6E69B7B84D1A86CD5AE8D9A7332C57543875FAA4FC7F1387A4CF83B7D662E4BAB0381E4AFC9CB9999075EBB497C6756DF770454F3530E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\fqs92o4p.default-release\key4.db

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader.exe.log

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.364175471524945
Encrypted:	false
SSDEEP:	24:ML9E4KQEAE4KKUNt1qE4GIsCKDE4KGKZI6KhPKIE4TKBGKoPE4K6sXE4Npv:MxHKQEAHKKkt1qHGIsCYHKGSI6oPtHTy
MD5:	D70164A2669BAC5564AE9329650DB5AE
SHA1:	D918ED8E2C94480B29A5FD1403F32C9555CADB60
SHA-256:	1795A022ED26274E44D1C5FE93C7CEDD53D18378FA2DF5B6EF91408F234B8A95
SHA-512:	82E357E433C1AFB7026A4E6D146743A0720C6E67062349CAC2795EC70A6B76B210F84A64CFEAB94D406AAA55D98A5BEAF5054FED9D0A322B66ED10BE15DAB9B5
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906

C:\Users\user\AppData\Local\Temp\tmp8681.tmp.tmpdb

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp86A1.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp871F.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8730.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8760.tmp.tmpdb

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8770.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8790.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp87A1.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.857944963844179
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Loader.exe
File size:	280'576 bytes
MD5:	c0feb087f1cfa85fdb001e059f4c95c7
SHA1:	1d9ab2eb37f85bea36f3e6ded442154181c96964
SHA256:	38957fb3708884f1a8befb0c17b0fa81f57005a5de058772cc12bf357c548eab
SHA512:	99d641dcebec431d905b83ea89b5b5fadd5c029215345834b604aeca23d25d236bbbe65c2d3179ad9d7597764d1791d9cfd18b3dc2d463acda6e1e72b6159a50
SSDEEP:	6144:cf+BLtABPDsth6Ej/UZkI4TjkRy5fafTy4lI1D080T:vtK+I4TjkRyTF1DcT
TLSH:	CF544C0027EC8B56E2FF4BB9E4B01161C3B1B466B83EDB4E6D4461DE2923780D955BB3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L............"...0..>...........8... ...`....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x443802
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC5F44CBF [Fri Mar 29 21:53:03 2075 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
adc byte ptr [ecx], dl
adc al, byte ptr [eax]
or byte ptr [edi], al
or dword ptr [esi], eax
or al, byte ptr [030C040Bh]
or eax, 0F010E02h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], cl
or byte ptr [eax], al
mov word ptr [eax], es
or byte ptr [eax], al
dec esp
add byte ptr [eax], cl
add ah, cl
add byte ptr [eax], cl
add byte ptr [eax+eax], ch
or byte ptr [eax], al
lodsb
add byte ptr [eax], cl
add byte ptr [eax+eax+08h], ch
add ah, ch
add byte ptr [eax], cl
add byte ptr [eax+eax], bl
or byte ptr [eax], al
pushfd
add byte ptr [eax], cl
add byte ptr [eax+eax+08h], bl
add ah, bl
add byte ptr [eax], cl
add byte ptr [eax+eax], bh
or byte ptr [eax], al
mov esp, 7C000800h
add byte ptr [eax], cl
add ah, bh
add byte ptr [eax], cl
add byte ptr [edx], al
add byte ptr [eax], cl
add byte ptr [edx+42000800h], al
add byte ptr [eax], cl
add dl, al
add byte ptr [eax], cl
add byte ptr [edx], ah
add byte ptr [eax], cl
add byte ptr [edx+62000800h], ah
add byte ptr [eax], cl
add dl, ah
add byte ptr [eax], cl
add byte ptr [edx], dl
add byte ptr [eax], cl
add byte ptr [edx+52000800h], dl
add byte ptr [eax], cl
add dl, dl
add byte ptr [eax], cl
add byte ptr [edx], dh
add byte ptr [eax], cl
add byte ptr [edx+72000800h], dh
add byte ptr [eax], cl
add dl, dh
add byte ptr [eax], cl
add byte ptr [edx], cl
add byte ptr [eax], cl
add byte ptr [edx+4A000800h], cl
add byte ptr [eax], cl
add dl, cl
add byte ptr [eax], cl
add byte ptr [edx], ch
add byte ptr [eax], cl
add byte ptr [edx+6A000800h], ch
add byte ptr [eax], cl
add dl, ch
add byte ptr [eax], cl
add byte ptr [edx], bl
add byte ptr [eax], cl
add byte ptr [edx+5A000800h], bl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x437b0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x5f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4371c	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x43df8	0x43e00	7c07c5888e5d8aaaf41fbdfae55e8ceb	False	0.4059694406077348	data	5.873261426186277	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x5f8	0x600	e56535dfcdf60b6c9b46ebd8049b15df	False	0.4361979166666667	data	4.264503201017009	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	2275898c85138789003e770a037ac41e	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x46090	0x368	data			0.4231651376146789
RT_MANIFEST	0x46408	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 12:38:59.799006939 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:38:59.799042940 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:38:59.799118996 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:38:59.819339037 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:38:59.819392920 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:39:00.299626112 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:39:00.299772024 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:39:00.303523064 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:39:00.303550005 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:39:00.303961039 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:39:00.352572918 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:39:00.361394882 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:39:00.403490067 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:39:00.461154938 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:39:00.461282015 CEST	443	49730	188.114.97.3	192.168.2.4
Sep 14, 2024 12:39:00.461338997 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:39:00.467883110 CEST	49730	443	192.168.2.4	188.114.97.3
Sep 14, 2024 12:39:00.487680912 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:00.487768888 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:00.487880945 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:00.488228083 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:00.488311052 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.188529015 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.188735962 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:01.208926916 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:01.208967924 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.209888935 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.218763113 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:01.263442993 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.531568050 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.531696081 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.531784058 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.531888008 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:01.531920910 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.531975985 CEST	443	49731	104.21.85.189	192.168.2.4
Sep 14, 2024 12:39:01.531990051 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:01.532037020 CEST	49731	443	192.168.2.4	104.21.85.189
Sep 14, 2024 12:39:01.540324926 CEST	49731	443	192.168.2.4	104.21.85.189

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 12:38:59.782867908 CEST	61255	53	192.168.2.4	1.1.1.1
Sep 14, 2024 12:38:59.791814089 CEST	53	61255	1.1.1.1	192.168.2.4
Sep 14, 2024 12:39:00.475488901 CEST	61640	53	192.168.2.4	1.1.1.1
Sep 14, 2024 12:39:00.486989975 CEST	53	61640	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 14, 2024 12:38:59.782867908 CEST	192.168.2.4	1.1.1.1	0x7e9	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)	false
Sep 14, 2024 12:39:00.475488901 CEST	192.168.2.4	1.1.1.1	0x4fb4	Standard query (0)	ipbase.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 14, 2024 12:38:59.791814089 CEST	1.1.1.1	192.168.2.4	0x7e9	No error (0)	freegeoip.app	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 14, 2024 12:38:59.791814089 CEST	1.1.1.1	192.168.2.4	0x7e9	No error (0)	freegeoip.app	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 14, 2024 12:39:00.486989975 CEST	1.1.1.1	192.168.2.4	0x4fb4	No error (0)	ipbase.com	104.21.85.189	A (IP address)	IN (0x0001)	false
Sep 14, 2024 12:39:00.486989975 CEST	1.1.1.1	192.168.2.4	0x4fb4	No error (0)	ipbase.com	172.67.209.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

freegeoip.app

ipbase.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	188.114.97.3	443	1732	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 10:39:00 UTC	67	OUT	GET /xml/ HTTP/1.1 Host: freegeoip.app Connection: Keep-Alive
2024-09-14 10:39:00 UTC	635	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 14 Sep 2024 10:39:00 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sat, 14 Sep 2024 11:39:00 GMT Location: https://ipbase.com/xml/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Be7RM2vkQ5hqKSLqbqisqE16t8YkEv6k%2BW37IfS05tyJ7O46iH1c1Vwr3xM0OGxsdukP1dfj9SO71pBYaC7eMyn1St0e3r53gohfv7FvOWdvytfINLUuc5DfJr5VRtE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c2fc02b98f56a58-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 10:39:00 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.85.189	443	1732	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 10:39:01 UTC	64	OUT	GET /xml/ HTTP/1.1 Host: ipbase.com Connection: Keep-Alive
2024-09-14 10:39:01 UTC	737	IN	HTTP/1.1 404 Not Found Date: Sat, 14 Sep 2024 10:39:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Age: 10899 Cache-Control: public,max-age=0,must-revalidate Cache-Status: "Netlify Edge"; hit Vary: Accept-Encoding X-Nf-Request-Id: 01J7R1TPV31H16NKRFQCHVFQ90 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5XuBdYnjcdt7DU%2FpomCHXBqMINcKqwIyis2qQ8xm5Zm0SDCbto%2BOdbVSZkkfUdt4WTiZwkFWq75e4lJpZnZL%2B5pvjgJlLSwVFKhoEWm83olY5nT6uOZzDwk%2Bk7GJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c2fc0321f1b8c57-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 10:39:01 UTC	632	IN	Data Raw: 63 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d Data Ascii: c0a<!DOCTYPE html><html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> <title>Page Not Found</title> <link href='https://fonts.googleapis.com
2024-09-14 10:39:01 UTC	1369	IN	Data Raw: 6e 67 3a 20 30 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 6d 61 69 6e 20 7b 0a 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a Data Ascii: ng: 0; } h1 { margin: 0; font-size: 22px; line-height: 24px; } .main { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; height:
2024-09-14 10:39:01 UTC	1088	IN	Data Raw: 20 20 20 20 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 30 30 37 30 36 37 22 20 64 3d 22 4d 31 31 2e 39 39 39 38 38 33 36 2c 34 2e 30 39 33 37 30 38 30 33 20 4c 38 2e 35 35 38 30 39 35 31 37 2c 37 2e 34 33 32 39 34 39 35 33 20 43 38 2e 32 33 35 33 31 34 35 39 2c 37 2e 37 34 36 31 31 32 39 38 20 38 2e 32 33 35 33 31 34 35 39 2c 38 2e 32 35 33 38 38 37 33 36 20 38 2e 35 35 38 30 39 35 31 37 2c 38 2e 35 36 36 39 33 37 36 39 20 4c 31 32 2c 31 31 2e 39 30 36 32 39 32 31 20 4c 39 2e 38 34 31 38 37 38 37 31 2c 31 34 20 4c 34 2e 32 34 32 30 38 35 34 34 2c 38 2e 35 36 36 39 33 37 35 31 20 43 33 2e 39 31 39 33 30 34 38 35 2c 38 2e 32 35 33 38 38 37 31 39 20 33 2e 39 31 39 33 30 34 38 35 2c 37 2e 37 34 36 31 31 32 38 31 20 34 2e 32 34 32 30 38 35 34 34 2c 37 2e 34 33 32 Data Ascii: <path fill="#007067" d="M11.9998836,4.09370803 L8.55809517,7.43294953 C8.23531459,7.74611298 8.23531459,8.25388736 8.55809517,8.56693769 L12,11.9062921 L9.84187871,14 L4.24208544,8.56693751 C3.91930485,8.25388719 3.91930485,7.74611281 4.24208544,7.432
2024-09-14 10:39:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:38:58
Start date:	14/09/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x1fd86360000
File size:	280'576 bytes
MD5 hash:	C0FEB087F1CFA85FDB001E059F4C95C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.1737602637.000001FD8829E000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_BlackGuard, Description: Yara detected BlackGuard, Source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000000.1703753257.000001FD86362000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000000.00000002.1737602637.000001FD881F7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B7D4726 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985718232346d73e8fb062f2ce6f6ee81625fc294095f4266eff2aa06d053c1f
Instruction ID: 41ae763f277465ec2969035feb25a810f3ba0427e118e228b241bee469e15af3
Opcode Fuzzy Hash: 985718232346d73e8fb062f2ce6f6ee81625fc294095f4266eff2aa06d053c1f
Instruction Fuzzy Hash: DCF1A230A09A8D8FEBA8DF28C8557E937E1FF94350F04436ED85DC72A5DB3499458B81

Function 00007FFD9B7D54D2 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77be82073710bce69e446fc71a30b751aab2f1ababafd2b34d7eebe196eca95c
Instruction ID: 985f6d4d41e77e0f9be9d3f6501b045b06d03f039cd179ebd720d41d89cc4d9c
Opcode Fuzzy Hash: 77be82073710bce69e446fc71a30b751aab2f1ababafd2b34d7eebe196eca95c
Instruction Fuzzy Hash: 27E1E430A09A8D8FEBA8DF28C8557E977E1FF94310F14436ED84DC72A1DB74A9448B81

Function 00007FFD9B7C13D3 Relevance: .4, Instructions: 437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbda9798ff420944d362ce73eed5b6cfe2e8f550d0ef172e87375ceabee8f4f8
Instruction ID: 48026ca4514b0a7976220223c9dec3d77a4c841baa953e8a651545e99ad1167d
Opcode Fuzzy Hash: fbda9798ff420944d362ce73eed5b6cfe2e8f550d0ef172e87375ceabee8f4f8
Instruction Fuzzy Hash: 50E13572A0E7865FE745F7B894A68E97BE0EF52220B0941FED099CB1F3DA1C1842C311

Function 00007FFD9B7C1448 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4a15359c1ce6fc925e9afed2602c3056e48aa0d55e8dd2488b617e555bbafd
Instruction ID: b0412173150aee173670181d027f3ecf8277c72b424ab6c3a37119fc3e221e73
Opcode Fuzzy Hash: 6d4a15359c1ce6fc925e9afed2602c3056e48aa0d55e8dd2488b617e555bbafd
Instruction Fuzzy Hash: 85C12671A0E78A5FD745EBB884669E97BE0EF52320B0901FED09ADB1F3DA1C5842C701

Function 00007FFD9B7C14A0 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eec431ec0df469ee7e02245fa541f1e9c2a171f41c39861f7de1ac85c0470f
Instruction ID: 787b45e3b7f9a475cc0eb264be8f7f621080ab692d241597e96c79264f4d78ff
Opcode Fuzzy Hash: 96eec431ec0df469ee7e02245fa541f1e9c2a171f41c39861f7de1ac85c0470f
Instruction Fuzzy Hash: DCB12571A0F7899FD745EBB884669E87BE0EF56320B0901FED05ADB5B3DA1C5842C701

Function 00007FFD9B7C1488 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ed24ea8e6420830857b1b050ec0f810ac36967a8b601a22ccef40408c503ae
Instruction ID: 543f4213ad4ad9ee7d348ef121c35188fbfd79b8bdbe1db0a124c5d5849cfa58
Opcode Fuzzy Hash: 89ed24ea8e6420830857b1b050ec0f810ac36967a8b601a22ccef40408c503ae
Instruction Fuzzy Hash: CCB1337190F78A9FE745ABB884669E87BE0EF5632070901FED09ADB5B3DA1C5842C701

Function 00007FFD9B7D7300 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI ref: 00007FFD9B7D73D8

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 159ee86dd63286449e8182c7cc1feacd3124b1b293cbc7f02a8d881b22102085
Instruction ID: 706d51086377eaccf411f7ce721e5ec03c780bf60a8b31fd064608dae1cd4693
Opcode Fuzzy Hash: 159ee86dd63286449e8182c7cc1feacd3124b1b293cbc7f02a8d881b22102085
Instruction Fuzzy Hash: F141F63090DB884FD719DBA898556E9BFF0EB96311F0442BFD089D71A3CB646809CB92

Non-executed Functions

Function 00007FFD9B7C573D Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1743464909.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e9b290bfc419be751cae0d87fdd5429c2efebdaa37e71cbbe25e216203d85c
Instruction ID: b4d5c03f7cfbf68afab8094866771dd06dc0d7589ec22b08a750a8988dbbf99e
Opcode Fuzzy Hash: 73e9b290bfc419be751cae0d87fdd5429c2efebdaa37e71cbbe25e216203d85c
Instruction Fuzzy Hash: 11710EA464E3C56FE75367B818725B67FE8DF8322971800EEE0D9CA0A7D90C1857C352

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: 44Caliber Stealer

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\44\Information.txt

C:\ProgramData\44\Process.txt

C:\ProgramData\44\Screen.png

C:\Users\Public\fqs92o4p.default-release\cert9.db

C:\Users\Public\fqs92o4p.default-release\key4.db

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader.exe.log

C:\Users\user\AppData\Local\Temp\tmp8681.tmp.tmpdb

C:\Users\user\AppData\Local\Temp\tmp86A1.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp871F.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8730.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8760.tmp.tmpdb

C:\Users\user\AppData\Local\Temp\tmp8770.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp8790.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp87A1.tmp.dat

Static File Info

Windows Analysis Report
Loader.exe

Function 00007FFD9B7D4726 Relevance: .5, Instructions: 472
COMMON

Function 00007FFD9B7D54D2 Relevance: .5, Instructions: 458
COMMON

Function 00007FFD9B7C13D3 Relevance: .4, Instructions: 437
COMMON

Function 00007FFD9B7D7300 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON