Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe
Analysis ID:	1537052
MD5:	09289584ed12a81a0a2a2d6df31df6da
SHA1:	26fb4b863c809c1dde042bf5fe9d1de98e694487
SHA256:	2ce4cfe235350e3cb4f613e988203e8c6745db826bcb1f0aa2399d9427ef2357
Tags:	exe
Infos:

Detection

XWorm

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe (PID: 4784 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe" MD5: 09289584ED12A81A0A2A2D6DF31DF6DA)

RegAsm.exe (PID: 1540 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1828 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d5a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6df7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6f0c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6bcc:$cnc4: POST / HTTP/1.1
00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6b42:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6bdf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6cf4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69b4:$cnc4: POST / HTTP/1.1
Process Memory Space: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe PID: 4784	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: RegAsm.exe PID: 1540	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegAsm.exe.e00000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.RegAsm.exe.e00000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d42:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6ddf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6ef4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6bb4:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T14:09:15.493292+0200	2855924	1	Malware Command and Control Activity Detected	192.168.2.7	50009	167.71.56.116	22781	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 1.2.RegAsm.exe.e00000.0.unpack	String decryptor: 167.71.56.116
Source: 1.2.RegAsm.exe.e00000.0.unpack	String decryptor: 22781
Source: 1.2.RegAsm.exe.e00000.0.unpack	String decryptor: <123456789>
Source: 1.2.RegAsm.exe.e00000.0.unpack	String decryptor: <Xwormmm>
Source: 1.2.RegAsm.exe.e00000.0.unpack	String decryptor: XWorm V5.2
Source: 1.2.RegAsm.exe.e00000.0.unpack	String decryptor: USB.exe

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: mscorlib.pdbowp source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\RegAsm.pdb2 source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb@ source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000001.00000002.3137270552.000000000616C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb8S source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.3132679665.0000000001309000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: orlib.pdbpdbi source: RegAsm.exe, 00000001.00000002.3132679665.0000000001309000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbve source: RegAsm.exe, 00000001.00000002.3137270552.0000000006158000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: %%.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbSystem.Configuration.dll< source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: n.pdbD source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3137270552.0000000006158000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp, WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Management.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb) source: RegAsm.exe, 00000001.00000002.3137270552.0000000006158000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Management.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.pdb* source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000001.00000002.3137270552.000000000616C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdbpdblib.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE53E.tmp.dmp.10.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.7:50009 -> 167.71.56.116:22781

Source: global traffic

TCP traffic: 192.168.2.7:49714 -> 167.71.56.116:22781

Source: Joe Sandbox View

IP Address: 167.71.56.116 167.71.56.116

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://certificates.godaddy.com/repository/gdroot.crl0K
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://certificates.godaddy.com/repository0
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://certs.starfieldtech.com/repository/1/0-
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://crl.godaddy.com/gds5-16.crl0S
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://crl.starfieldtech.com/sfsroot.crl0S
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://ocsp.godaddy.com0F
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: http://ocsp.starfieldtech.com/09
Source: RegAsm.exe, 00000001.00000002.3133252811.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	String found in binary or memory: https://certs.starfieldtech.com/repository/0

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegAsm.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01228390	1_2_01228390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01225F88	1_2_01225F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012256B8	1_2_012256B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01225370	1_2_01225370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01220BA0	1_2_01220BA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1828

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: Number of sections : 11 > 10

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe, 00000000.00000003.1286439675.000000007EC3D000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamerawworm.exe4 vs SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.RegAsm.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal96.troj.evad.winEXE@4/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\zHFSP3mGN1gkADEH
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1540

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\41d91e62-cda1-44d0-ac06-c94da56fb8f8

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1828
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static file information: File size 2121456 > 1048576

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x13ee00

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: mscorlib.pdbowp source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\RegAsm.pdb2 source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb@ source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000001.00000002.3137270552.000000000616C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb8S source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.3132679665.0000000001309000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: orlib.pdbpdbi source: RegAsm.exe, 00000001.00000002.3132679665.0000000001309000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbve source: RegAsm.exe, 00000001.00000002.3137270552.0000000006158000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: %%.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbSystem.Configuration.dll< source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: n.pdbD source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3137270552.0000000006158000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp, WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Management.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb) source: RegAsm.exe, 00000001.00000002.3137270552.0000000006158000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Management.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.pdb* source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000001.00000002.3137270552.000000000616C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdbpdblib.pdb source: RegAsm.exe, 00000001.00000002.3135293089.000000000544A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.ni.pdb source: WERE53E.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE53E.tmp.dmp.10.dr

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: real checksum: 0x211b73 should be: 0x20c29e

Source: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Static PE information: section name: .didata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_01227223 push esp; ret

1_2_01227229

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4CF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 9495			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 355			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3540	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3540	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1240	Thread sleep count: 9495 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1240	Thread sleep count: 355 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E00000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E00000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E00000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E02000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E0A000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E66000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C15008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: RegAsm.exe, 00000001.00000002.3132679665.0000000001288000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.3132679665.0000000001309000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 1.2.RegAsm.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe PID: 4784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1540, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 1.2.RegAsm.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe PID: 4784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1540, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	141 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	50%	ReversingLabs	Win32.Trojan.NeptuneLoader

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.godaddy.com/gds5-16.crl0S	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://certs.starfieldtech.com/repository/1/0-	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
https://certs.starfieldtech.com/repository/0	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://certificates.godaddy.com/repository/0	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://ocsp.starfieldtech.com/09	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://certificates.godaddy.com/repository100.	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://upx.sf.net	Amcache.hve.10.dr	false	URL Reputation: safe	unknown
http://certificates.starfieldtech.com/repository/1604	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://certificates.godaddy.com/repository/gd_intermediate.crt0	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000001.00000002.3133252811.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.starfieldtech.com/sfsroot.crl0S	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://certificates.godaddy.com/repository0	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown
http://certificates.godaddy.com/repository/gdroot.crl0K	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.71.56.116	unknown	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537052
Start date and time:	2024-10-18 14:06:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@4/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): onedsblobprdcus15.centralus.cloudapp.azure.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Simulations

Behavior and APIs

Time	Type	Description
08:07:34	API Interceptor	4449564x Sleep call for process: RegAsm.exe modified
09:18:37	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
167.71.56.116	X.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe	Get hash	malicious	XWorm	Browse
	WinScanGuard_v.2.1.bat	Get hash	malicious	Quasar	Browse
	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse
	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse
	zUYpYikG7T.exe	Get hash	malicious	njRat	Browse
	SdwkQEBnc3.exe	Get hash	malicious	Nanocore	Browse
	riV1K85Awe.exe	Get hash	malicious	Nanocore	Browse
	Malwarebytes Gears.exe	Get hash	malicious	AsyncRAT	Browse
	H8RZSly6dG.exe	Get hash	malicious	Njrat	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	https://sites.google.com/view/hffgshfgsqfgsqf/home	Get hash	malicious	Unknown	Browse	138.68.75.10
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	103.253.147.242
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	103.253.147.242
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	103.253.147.242
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	103.253.147.242
	earm5.elf	Get hash	malicious	Unknown	Browse	103.253.147.242
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	103.253.147.242
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	103.253.147.242
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	162.243.19.47
	https://www.google.kz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2F%E2%80%8Blu%C2%ADi%C2%ADse%C2%ADdu%C2%ADardo%C2%ADdias%E2%80%8B.c%C2%ADo%C2%ADm.b%C2%ADr/z/dGVjaG5pY2FsQGxtbS5ncg==	Get hash	malicious	Unknown	Browse	161.35.71.107

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_9be59e14b6b73c7898b15b8fa4185e5466451f4_38d14e40_eaf77835-1e61-4326-8852-8f37b184aff2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2822384333069519
Encrypted:	false
SSDEEP:	192:9vvbeFy/uVKN0BU/qaUtY3oXcsxLzuiF/Z24IO8V5:9XluVzBU/qaUtXcEzuiF/Y4IO8V
MD5:	FF3B4F929624F719F6213D7221D654A0
SHA1:	A21803F753766BE95DFF1E6F531CBFF755F59653
SHA-256:	A33925DFED8618B611C4C16E32BDE8CDAFF2359B799806507E7CDC53BEC29125
SHA-512:	B37663E6905A81BA6B82375896A1C9084A778369ACE15BF3C6F61A089B96FB94F7DF99E602F9C02D6AC7080EA22D3D6E53C50041994DFF684C60D98B719A1F1D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.7.3.1.1.0.2.1.3.6.6.8.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.7.3.1.1.0.2.6.5.2.3.7.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.f.7.7.8.3.5.-.1.e.6.1.-.4.3.2.6.-.8.8.5.2.-.8.f.3.7.b.1.8.4.a.f.f.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.1.8.7.4.a.8.-.4.4.a.6.-.4.b.8.e.-.b.5.c.8.-.0.4.d.8.1.f.d.0.5.7.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.A.s.m...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.A.s.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.4.-.0.0.0.1.-.0.0.1.4.-.9.f.5.f.-.2.4.4.c.5.6.2.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.3.0.a.b.5.5.5.9.e.8.0.6.5.7.4.d.2.6.b.4.c.2.0.8.4.7.c.3.6.8.e.d.5.5.4.8.3.b.0.!.R.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE53E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 18 13:18:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	285655
Entropy (8bit):	3.7766900047446073
Encrypted:	false
SSDEEP:	3072:V5UqWAQayI7U4uEqfMPvHfLTgo2QZeNzzU6BCjHtX8:DUqCayqU4yMTTgoVeN3UwCJs
MD5:	D7FA7AB8DD9F1945937EA8312C76D905
SHA1:	9C9C7B3A4567EC7EB962C7511C1D8588288A3AF4
SHA-256:	0585D6D6255E589C2A1C9A9F00B800CFF42931E9A75EAB7BB3CF04A05656031B
SHA-512:	2A95B0CE08EF3383DD1C9E41860C54C5A158A70CC6695975475F98A960A6AD17AAD11D0C0F3AB462D7E4BBAF2CD01B49190569CF12A4473E1D0559270768253F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........`.g............t...........t#..\|........"...`..........T.......8...........T............A...............,..........................................................................................eJ......t/......GenuineIntel............T...........~O.g....L........................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE697.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6378
Entropy (8bit):	3.7148771222472727
Encrypted:	false
SSDEEP:	192:R6l7wVeJeYA6IwrrYZOxprD89bNsQ4sfEPm:R6lXJm6IQY8oNsQrfx
MD5:	82589AD71B5EB95386839A616D9BB438
SHA1:	9F2348AE29E828C4550D85FFF5F4C5C76BD6B7C7
SHA-256:	F80B38C42D1953ADBFA8785AD867080D36B8666FAE889CEA8AA17951777F60FC
SHA-512:	63527E95BEECE3981C56253E1EC4631BA94A5BAA158E8FD08261D7AC06904BBF03CD438D6EB44044249CC55ADC0005F626B79EEE1A9A4658419DD7D39713D630
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6B7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4721
Entropy (8bit):	4.435752713483193
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9QbWpW8VYPjYm8M4JfuyziF1I+q8vZyzc5QgLuOLuWrd:uIjfdI7aq7VXJfua0IKZac5BukuWrd
MD5:	F6A05307147E900FF9552C670705A941
SHA1:	B2D50E011BC6B438800B890D6B7E2DF3BF75780F
SHA-256:	BBADF6ED4124B4C119D8876724DEF9EA77A6416D3D9E09E43BB96EB23521C1CE
SHA-512:	D55184F3A875BF1E76608AB8F8BA14729E0F95E4FBEA6C554455AC4C50D0C15B3417E7C6A53E5C598669008DA9DCE9DEDF6918A2047F6D9BAD1CEC11576DA7C2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="548901" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417535697182074
Encrypted:	false
SSDEEP:	6144:Ocifpi6ceLPL9skLmb0mdSWSPtaJG8nAgex285i2MMhA20X4WABlGuNL5+:bi58dSWIZBk2MM6AFBlo
MD5:	40313EB3A3CBB6751F70A0AF1FC1A91D
SHA1:	82C9C7F685CBEEBCAE4B039713B66A417E949E0C
SHA-256:	45F2799EA60DEB05A83874B39FEE44F1E5C0A110EC70DF6C887D7B7B6D0E6005
SHA-512:	6DAB42C66AFC783CAA38FCD6EC1F1F2B983231E030E9AC8F9010387A155595DE611A89F27DE7754195F87AC6A2D2EFD415E4156E5EAF8D36E66327178EBCD804
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmR.4`!...............................................................................................................................................................................................................................................................................................................................................0..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.309641950556383
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe
File size:	2'121'456 bytes
MD5:	09289584ed12a81a0a2a2d6df31df6da
SHA1:	26fb4b863c809c1dde042bf5fe9d1de98e694487
SHA256:	2ce4cfe235350e3cb4f613e988203e8c6745db826bcb1f0aa2399d9427ef2357
SHA512:	e6d4cea771d4cdc0fa958aef23fc7f9ad575b2e49bec65e8b22fb2de5ce551de6936d052544004200a097410fbb7109b7d6f71d1c01889bb9b5e0dc53fb72ac7
SSDEEP:	24576:QljLYQBtY2rLbnoQVNYRvobF5ZIMfffffffffffffffTEqNrK2Y/l6q3:QxbB7VYSMR/l6q3
TLSH:	5AA5F703EF6452B5E93D36BA11B26BB5473BE52BDC8B480A59B3347F8A231D0382D355
File Content Preview:	MZP.....................@...............................................!..L.!This program cannot be run in DOS mode....$......................................................................................................................................

File Icon


Icon Hash:	2bbd7b3bbb91184c

Static PE Info

General

Entrypoint:	0x541228
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6594420D [Tue Jan 2 17:04:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c27196cb386d9c2fcebfe58d6b783f7f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	23/04/2013 18:46:49 23/04/2016 18:46:49
Subject Chain	CN=TallApplications BV, O=TallApplications BV, L=Grubbenvorst, S=Limburg, C=NL
Version:	3
Thumbprint MD5:	0CFB7685B54EF58E0DD65B242E82E080
Thumbprint SHA-1:	2D5609B5B7FB15C2CCF27F91E6AF062511E37170
Thumbprint SHA-256:	751E9D2F2901B771BE8DA1AFB24B2D3E51E4EA32B8E21CA425DD280701608FBA
Serial:	07AD5CFABFBBAA

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
mov ecx, 0000000Dh
push 00000000h
push 00000000h
dec ecx
jne 00007EFE1C6E85ABh
push ebx
push esi
mov eax, 0053AF30h
call 00007EFE1C5B850Eh
xor eax, eax
push ebp
push 00541838h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov dl, 01h
mov eax, dword ptr [0053ABCCh]
call 00007EFE1C5AF714h
mov esi, eax
mov eax, 00561A68h
mov edx, esi
test edx, edx
je 00007EFE1C6E85B5h
sub edx, FFFFFFF8h
call 00007EFE1C5B5C03h
xor eax, eax
mov dword ptr [ebp-14h], eax
xor ecx, ecx
push ebp
push 005417F9h
push dword ptr fs:[ecx]
mov dword ptr fs:[ecx], esp
lea edx, dword ptr [ebp-14h]
mov eax, 00000001h
call 00007EFE1C6E0C77h
xor eax, eax
mov dword ptr [ebp-18h], eax
xor ecx, ecx
push ebp
push 005417DAh
push dword ptr fs:[ecx]
mov dword ptr fs:[ecx], esp
lea edx, dword ptr [ebp-18h]
mov eax, 00000002h
call 00007EFE1C6E0C57h
mov edx, dword ptr [ebp-18h]
mov eax, edx
test eax, eax
je 00007EFE1C6E85B7h
sub eax, 04h
mov eax, dword ptr [eax]
test eax, eax
jle 00007EFE1C6E85C6h
mov eax, edx
test eax, eax
je 00007EFE1C6E85B7h
sub eax, 04h
mov eax, dword ptr [eax]
lea edx, dword ptr [ebp-18h]
xchg eax, edx
call 00007EFE1C5B2035h
lea ecx, dword ptr [ebp-44h]
mov edx, 00541854h
mov eax, dword ptr [ebp-18h]
call 00007EFE1C679449h
mov edx, dword ptr [ebp-44h]
mov eax, 00561A4Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x164000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x162000	0xeaa	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x180000	0x91842	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x204a00	0x14f0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x167000	0x18968	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x166000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1622c4	0x24c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x163000	0x1ea	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13ec30	0x13ee00	c51c6cb37ed5ce0e3f5505dc3ac403bc	False	0.36596019330654644	data	6.490706528468914	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x140000	0x1934	0x1a00	7ac92331d0c7df1bc9e4c0d07104c159	False	0.5147235576923077	data	6.232517754168578	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x142000	0x182d4	0x18400	a20ea187c764645fcd5c35d906f0f7f6	False	0.18651336984536082	data	5.281725279036479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x15b000	0x6a6c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x162000	0xeaa	0x1000	3cf5ec88566996006540ea535e613c5c	False	0.352294921875	zlib compressed data	4.7520074705410895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x163000	0x1ea	0x200	61251115c0a0c926bd55f02b7ec230a7	False	0.416015625	firmware 100 v0 (revision 1915819520) (1\026 , version 52263.16640.35879 (region 2284852736), 0 bytes or less, UNKNOWN1 0x88301600, at 0 0 bytes , at 0 0 bytes , at 0x48534000 3226615808 bytes	3.345822242610369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x164000	0x71	0x200	93b1b87c3109e7fee7b3e8bb61ade18e	False	0.1796875	data	1.3456704524513246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x165000	0x20	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x166000	0x5d	0x200	fdcc303ff40bb15074bd3ec3e38eac94	False	0.189453125	data	1.376875570449468	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x167000	0x18968	0x18a00	17ed0a2e57f1b8c5b6904d0a2d26f915	False	0.528216211928934	data	6.669990802122488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x180000	0x91842	0x91a00	1608fa01be6fd3aefd5f8e76194afd48	False	0.1028014350858369	data	3.4961514116837944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x180618	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.47681236673773986
RT_ICON	0x1814c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.6078519855595668
RT_ICON	0x181d68	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.4971198156682028
RT_ICON	0x182430	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.5852601156069365
RT_ICON	0x182998	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.30933609958506225
RT_ICON	0x184f40	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.40384615384615385
RT_ICON	0x185fe8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.4319672131147541
RT_ICON	0x186970	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5939716312056738
RT_STRING	0x186dd8	0x33c	data			0.4190821256038647
RT_STRING	0x187114	0x3dc	data			0.2834008097165992
RT_STRING	0x1874f0	0x370	data			0.4147727272727273
RT_STRING	0x187860	0x464	data			0.37277580071174377
RT_STRING	0x187cc4	0x4a8	data			0.3213087248322148
RT_STRING	0x18816c	0x3d4	data			0.376530612244898
RT_STRING	0x188540	0x440	data			0.3704044117647059
RT_STRING	0x188980	0x1d0	data			0.40301724137931033
RT_STRING	0x188b50	0xcc	data			0.6225490196078431
RT_STRING	0x188c1c	0x17c	data			0.55
RT_STRING	0x188d98	0x384	data			0.3811111111111111
RT_STRING	0x18911c	0x3e0	data			0.3326612903225806
RT_STRING	0x1894fc	0x368	data			0.37844036697247707
RT_STRING	0x189864	0x294	data			0.43787878787878787
RT_RCDATA	0x189af8	0x10	data			1.5
RT_RCDATA	0x189b08	0x40c	data			0.5318532818532818
RT_GROUP_ICON	0x189f14	0x76	data			0.6610169491525424
RT_VERSION	0x189f8c	0x4b8	COM executable for DOS	English	United States	0.3120860927152318
RT_HTML	0x18a444	0x873f3	data			0.08053670679512104
RT_HTML	0x211838	0xa	ASCII text, with no line terminators			1.8

Imports

DLL	Import
kernel32.dll	GetACP, CloseHandle, LocalFree, SizeofResource, ReadProcessMemory, QueryPerformanceFrequency, IsDebuggerPresent, VirtualFree, SetThreadContext, GetThreadContext, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, WriteProcessMemory, RtlUnwind, GetCPInfo, EnumSystemLocalesW, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, CopyFileW, LoadLibraryA, ResetEvent, GetVersion, FreeResource, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, ReleaseMutex, LoadResource, SuspendThread, GetTickCount, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, VirtualAllocEx, GetVersionExW, VerifyVersionInfoW, HeapCreate, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, CreateMutexA, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, IsValidLocale, TlsSetValue, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, CreateEventW, SetThreadLocale, GetThreadLocale
user32.dll	CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, CharLowerBuffW, LoadStringW, CharUpperW, PeekMessageW, GetSystemMetrics, MessageBoxW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
msvcrt.dll	isupper, isalpha, isalnum, toupper, memchr, memcmp, memcpy, memset, isprint, isspace, iscntrl, isxdigit, ispunct, isgraph, islower, tolower
advapi32.dll	RegQueryValueExW, RegCloseKey, RegOpenKeyExW

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x411070
dbkFCallWrapperAddr	1	0x55e63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-18T14:09:15.493292+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.7	50009	167.71.56.116	22781	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2024 14:07:35.197186947 CEST	49714	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:35.202147961 CEST	22781	49714	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:35.202279091 CEST	49714	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:35.299407959 CEST	49714	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:35.304260969 CEST	22781	49714	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:35.807558060 CEST	22781	49714	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:35.807643890 CEST	49714	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:39.695691109 CEST	49714	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:39.696995974 CEST	49740	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:39.700562000 CEST	22781	49714	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:39.701874971 CEST	22781	49740	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:39.701975107 CEST	49740	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:39.725502968 CEST	49740	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:39.730410099 CEST	22781	49740	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:40.323682070 CEST	22781	49740	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:40.323802948 CEST	49740	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:43.039573908 CEST	49740	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:43.040503979 CEST	49757	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:43.064047098 CEST	22781	49740	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:43.064069033 CEST	22781	49757	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:43.064156055 CEST	49757	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:43.088618994 CEST	49757	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:43.093553066 CEST	22781	49757	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:43.675582886 CEST	22781	49757	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:43.675885916 CEST	49757	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:47.891036034 CEST	49757	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:47.893939018 CEST	49786	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:47.895817995 CEST	22781	49757	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:47.898710966 CEST	22781	49786	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:47.898762941 CEST	49786	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:48.072127104 CEST	49786	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:48.077035904 CEST	22781	49786	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:48.505624056 CEST	22781	49786	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:48.505726099 CEST	49786	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:51.570723057 CEST	49786	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:51.572331905 CEST	49809	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:51.575747967 CEST	22781	49786	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:51.578500986 CEST	22781	49809	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:51.578568935 CEST	49809	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:51.640732050 CEST	49809	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:51.645929098 CEST	22781	49809	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:52.188595057 CEST	22781	49809	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:52.188662052 CEST	49809	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:52.289459944 CEST	49809	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:52.290769100 CEST	49813	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:52.295883894 CEST	22781	49809	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:52.296714067 CEST	22781	49813	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:52.296785116 CEST	49813	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:52.321935892 CEST	49813	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:52.326932907 CEST	22781	49813	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:52.913460970 CEST	22781	49813	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:52.913562059 CEST	49813	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:57.461303949 CEST	49813	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:57.462872982 CEST	49844	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:57.466677904 CEST	22781	49813	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:57.467791080 CEST	22781	49844	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:57.467861891 CEST	49844	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:57.493340015 CEST	49844	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:57.498404026 CEST	22781	49844	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:58.683520079 CEST	22781	49844	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:58.683667898 CEST	49844	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:58.683885098 CEST	22781	49844	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:58.683989048 CEST	49844	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:07:58.684732914 CEST	22781	49844	167.71.56.116	192.168.2.7
Oct 18, 2024 14:07:58.684788942 CEST	49844	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:01.758122921 CEST	49844	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:01.759607077 CEST	49860	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:01.763149977 CEST	22781	49844	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:01.764626026 CEST	22781	49860	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:01.764704943 CEST	49860	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:01.782706022 CEST	49860	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:01.790512085 CEST	22781	49860	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:02.361145020 CEST	22781	49860	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:02.361221075 CEST	49860	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:06.477111101 CEST	49860	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:06.478296041 CEST	49890	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:06.483997107 CEST	22781	49860	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:06.484757900 CEST	22781	49890	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:06.484833002 CEST	49890	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:06.501818895 CEST	49890	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:06.511410952 CEST	22781	49890	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:07.098946095 CEST	22781	49890	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:07.099049091 CEST	49890	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:11.461443901 CEST	49890	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:11.462374926 CEST	49917	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:11.467978001 CEST	22781	49890	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:11.468046904 CEST	22781	49917	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:11.468138933 CEST	49917	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:11.484376907 CEST	49917	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:11.489353895 CEST	22781	49917	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:12.082104921 CEST	22781	49917	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:12.082180977 CEST	49917	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:14.414498091 CEST	49917	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:14.416580915 CEST	49936	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:14.419508934 CEST	22781	49917	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:14.421515942 CEST	22781	49936	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:14.421596050 CEST	49936	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:14.451001883 CEST	49936	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:14.455846071 CEST	22781	49936	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:15.046005964 CEST	22781	49936	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:15.046132088 CEST	49936	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:17.320676088 CEST	49936	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:17.322350025 CEST	49954	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:17.325763941 CEST	22781	49936	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:17.327306032 CEST	22781	49954	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:17.327382088 CEST	49954	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:17.346410990 CEST	49954	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:17.352056980 CEST	22781	49954	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:17.930115938 CEST	22781	49954	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:17.930217981 CEST	49954	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:19.805001974 CEST	49954	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:19.805670023 CEST	49969	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:19.810637951 CEST	22781	49954	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:19.813611031 CEST	22781	49969	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:19.813678980 CEST	49969	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:19.828150988 CEST	49969	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:19.833308935 CEST	22781	49969	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:20.442128897 CEST	22781	49969	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:20.442217112 CEST	49969	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:21.789463043 CEST	49969	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:21.790360928 CEST	49982	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:21.794646978 CEST	22781	49969	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:21.799995899 CEST	22781	49982	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:21.800095081 CEST	49982	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:21.815999031 CEST	49982	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:21.823003054 CEST	22781	49982	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:22.500119925 CEST	22781	49982	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:22.500186920 CEST	49982	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:23.765489101 CEST	49982	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:23.769953966 CEST	49987	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:23.779652119 CEST	22781	49982	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:23.780236959 CEST	22781	49987	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:23.780318975 CEST	49987	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:24.376769066 CEST	49987	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:24.383722067 CEST	22781	49987	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:24.386051893 CEST	22781	49987	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:24.386116982 CEST	49987	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:24.445847988 CEST	49987	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:24.450619936 CEST	49988	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:24.450767040 CEST	22781	49987	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:24.455452919 CEST	22781	49988	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:24.455526114 CEST	49988	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:24.561115980 CEST	49988	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:24.566199064 CEST	22781	49988	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:25.053076029 CEST	22781	49988	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:25.053240061 CEST	49988	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:26.383224010 CEST	49988	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:26.384138107 CEST	49989	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:26.388390064 CEST	22781	49988	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:26.389195919 CEST	22781	49989	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:26.389266014 CEST	49989	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:26.407402992 CEST	49989	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:26.412379026 CEST	22781	49989	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:26.986089945 CEST	22781	49989	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:26.986330986 CEST	49989	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:28.042514086 CEST	49989	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:28.045309067 CEST	49990	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:28.047646999 CEST	22781	49989	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:28.050508976 CEST	22781	49990	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:28.050579071 CEST	49990	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:28.124339104 CEST	49990	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:28.129498959 CEST	22781	49990	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:28.651015043 CEST	22781	49990	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:28.651084900 CEST	49990	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:29.289578915 CEST	49990	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:29.291184902 CEST	49991	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:29.295346975 CEST	22781	49990	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:29.296590090 CEST	22781	49991	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:29.296857119 CEST	49991	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:29.313489914 CEST	49991	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:29.320894957 CEST	22781	49991	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:29.894649029 CEST	22781	49991	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:29.894907951 CEST	49991	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:30.617573977 CEST	49991	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:30.618419886 CEST	49992	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:30.622633934 CEST	22781	49991	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:30.623788118 CEST	22781	49992	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:30.623898983 CEST	49992	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:30.643780947 CEST	49992	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:30.648863077 CEST	22781	49992	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:31.245945930 CEST	22781	49992	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:31.246089935 CEST	49992	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:31.539433002 CEST	49992	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:31.540539980 CEST	49993	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:31.544553041 CEST	22781	49992	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:31.545739889 CEST	22781	49993	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:31.545825958 CEST	49993	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:31.567186117 CEST	49993	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:31.572247982 CEST	22781	49993	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:32.341016054 CEST	22781	49993	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:32.341156006 CEST	49993	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:32.399038076 CEST	49993	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:32.400218010 CEST	49994	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:32.404854059 CEST	22781	49993	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:32.405630112 CEST	22781	49994	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:32.405759096 CEST	49994	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:32.427752972 CEST	49994	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:32.432740927 CEST	22781	49994	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.020369053 CEST	22781	49994	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.020529985 CEST	49994	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.258157015 CEST	49994	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.259076118 CEST	49995	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.263196945 CEST	22781	49994	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.264266968 CEST	22781	49995	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.264353991 CEST	49995	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.280724049 CEST	49995	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.286983013 CEST	22781	49995	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.882023096 CEST	22781	49995	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.882266045 CEST	49995	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.978084087 CEST	49995	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.979921103 CEST	49996	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:33.985893011 CEST	22781	49995	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.986926079 CEST	22781	49996	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:33.987023115 CEST	49996	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:34.006671906 CEST	49996	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:34.012892008 CEST	22781	49996	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:34.608427048 CEST	22781	49996	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:34.608500957 CEST	49996	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.008270979 CEST	49996	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.008976936 CEST	49997	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.022394896 CEST	22781	49996	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:35.024431944 CEST	22781	49997	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:35.024863958 CEST	49997	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.040565014 CEST	49997	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.046315908 CEST	22781	49997	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:35.640820980 CEST	22781	49997	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:35.640887022 CEST	49997	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.743150949 CEST	49997	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.745285034 CEST	49998	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.749279022 CEST	22781	49997	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:35.752190113 CEST	22781	49998	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:35.752283096 CEST	49998	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.794491053 CEST	49998	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:35.799546003 CEST	22781	49998	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:36.361709118 CEST	22781	49998	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:36.361779928 CEST	49998	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:36.539504051 CEST	49998	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:36.541551113 CEST	49999	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:36.544536114 CEST	22781	49998	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:36.547200918 CEST	22781	49999	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:36.547275066 CEST	49999	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:36.579345942 CEST	49999	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:36.584461927 CEST	22781	49999	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.148895979 CEST	22781	49999	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.152906895 CEST	49999	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.258174896 CEST	49999	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.260605097 CEST	50000	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.263354063 CEST	22781	49999	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.265988111 CEST	22781	50000	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.266088963 CEST	50000	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.291207075 CEST	50000	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.308943033 CEST	22781	50000	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.880815983 CEST	22781	50000	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.880925894 CEST	50000	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.883809090 CEST	50000	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.885420084 CEST	50001	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.888629913 CEST	22781	50000	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.890558004 CEST	22781	50001	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:37.890667915 CEST	50001	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.911129951 CEST	50001	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:37.916038036 CEST	22781	50001	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:38.492400885 CEST	22781	50001	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:38.492528915 CEST	50001	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:38.493860006 CEST	50001	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:38.498692036 CEST	22781	50001	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:38.514398098 CEST	50002	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:38.519309998 CEST	22781	50002	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:38.520124912 CEST	50002	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:38.542150021 CEST	50002	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:38.547074080 CEST	22781	50002	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:39.117603064 CEST	22781	50002	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:39.117711067 CEST	50002	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:43.883266926 CEST	50002	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:43.884825945 CEST	50003	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:43.888186932 CEST	22781	50002	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:43.890338898 CEST	22781	50003	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:43.890419960 CEST	50003	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:43.940310001 CEST	50003	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:43.945342064 CEST	22781	50003	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:43.956545115 CEST	50003	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:43.961476088 CEST	22781	50003	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:44.499233007 CEST	22781	50003	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:44.499450922 CEST	50003	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:48.961491108 CEST	50003	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:48.962404013 CEST	50004	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:48.966497898 CEST	22781	50003	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:48.967263937 CEST	22781	50004	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:48.967401028 CEST	50004	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:49.004990101 CEST	50004	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:49.010015011 CEST	22781	50004	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:49.576527119 CEST	22781	50004	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:49.576622009 CEST	50004	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.148864031 CEST	50004	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.153125048 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.154252052 CEST	22781	50004	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.158113003 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.158188105 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.201013088 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.205967903 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.227576017 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.232357025 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.461687088 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.466703892 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.493259907 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.498330116 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.508364916 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.513323069 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.540133953 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.545133114 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.602217913 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.607148886 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.617824078 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.622724056 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.695934057 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:54.701015949 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.764931917 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:54.765033960 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:59.742563009 CEST	50005	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:59.745263100 CEST	50006	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:59.747560024 CEST	22781	50005	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:59.750102997 CEST	22781	50006	167.71.56.116	192.168.2.7
Oct 18, 2024 14:08:59.750226974 CEST	50006	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:59.860810995 CEST	50006	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:08:59.865801096 CEST	22781	50006	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:00.349772930 CEST	22781	50006	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:00.349833965 CEST	50006	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:04.883291006 CEST	50006	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:04.884968996 CEST	50007	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:04.888283014 CEST	22781	50006	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:04.889873981 CEST	22781	50007	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:04.889976978 CEST	50007	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:04.919812918 CEST	50007	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:04.924720049 CEST	22781	50007	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:05.485898972 CEST	22781	50007	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:05.485971928 CEST	50007	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:09.930206060 CEST	50007	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:09.932667971 CEST	50008	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:09.935168028 CEST	22781	50007	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:09.937629938 CEST	22781	50008	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:09.937712908 CEST	50008	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:10.125859976 CEST	50008	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:10.130789995 CEST	22781	50008	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:10.548003912 CEST	22781	50008	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:10.548084974 CEST	50008	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:15.415466070 CEST	50008	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:15.417583942 CEST	50009	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:15.420351028 CEST	22781	50008	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:15.422646046 CEST	22781	50009	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:15.422715902 CEST	50009	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:15.471873999 CEST	50009	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:15.476809978 CEST	22781	50009	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:15.493292093 CEST	50009	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:15.499926090 CEST	22781	50009	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:16.031352043 CEST	22781	50009	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:16.031502962 CEST	50009	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:20.867572069 CEST	50009	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:20.868762016 CEST	50010	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:20.872442007 CEST	22781	50009	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:20.873611927 CEST	22781	50010	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:20.873708010 CEST	50010	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:20.972224951 CEST	50010	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:20.977087021 CEST	22781	50010	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:21.470021963 CEST	22781	50010	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:21.470082998 CEST	50010	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:26.039719105 CEST	50010	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:26.042565107 CEST	50011	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:26.045706034 CEST	22781	50010	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:26.048372984 CEST	22781	50011	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:26.048772097 CEST	50011	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:26.087084055 CEST	50011	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:26.092122078 CEST	22781	50011	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:26.651211023 CEST	22781	50011	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:26.651307106 CEST	50011	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:31.938153028 CEST	50011	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:31.941442966 CEST	50012	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:31.943041086 CEST	22781	50011	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:31.946321011 CEST	22781	50012	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:31.946398973 CEST	50012	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.388362885 CEST	50012	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.393368006 CEST	22781	50012	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:32.550098896 CEST	22781	50012	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:32.550169945 CEST	50012	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.551224947 CEST	50012	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.553397894 CEST	50013	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.556240082 CEST	22781	50012	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:32.558170080 CEST	22781	50013	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:32.558243990 CEST	50013	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.615752935 CEST	50013	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.620656013 CEST	22781	50013	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:32.867938995 CEST	50013	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.872826099 CEST	22781	50013	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:32.883671999 CEST	50013	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:32.888494968 CEST	22781	50013	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:33.163189888 CEST	22781	50013	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:33.163285971 CEST	50013	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:37.977060080 CEST	50013	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:37.980254889 CEST	50014	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:37.981853008 CEST	22781	50013	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:37.985008001 CEST	22781	50014	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:37.985083103 CEST	50014	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:38.031229019 CEST	50014	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:38.036473989 CEST	22781	50014	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:38.164679050 CEST	50014	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:38.169585943 CEST	22781	50014	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:38.596219063 CEST	22781	50014	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:38.596308947 CEST	50014	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:43.273890972 CEST	50014	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:43.274960041 CEST	50015	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:43.278939962 CEST	22781	50014	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:43.279769897 CEST	22781	50015	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:43.279838085 CEST	50015	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:43.317435980 CEST	50015	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:43.322319031 CEST	22781	50015	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:43.888209105 CEST	22781	50015	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:43.888807058 CEST	50015	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:48.486605883 CEST	50015	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:48.491509914 CEST	22781	50015	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:48.551410913 CEST	50016	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:48.560668945 CEST	22781	50016	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:48.560745001 CEST	50016	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:48.906105995 CEST	50016	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:48.910912037 CEST	22781	50016	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.167678118 CEST	22781	50016	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.168912888 CEST	50016	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.172003984 CEST	50016	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.177519083 CEST	22781	50016	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.178673029 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.183542013 CEST	22781	50017	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.184801102 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.227715015 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.232515097 CEST	22781	50017	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.383646011 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.388434887 CEST	22781	50017	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.586714029 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.591645956 CEST	22781	50017	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.743093014 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.747827053 CEST	22781	50017	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.781749964 CEST	22781	50017	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.781826973 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.781873941 CEST	50017	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.782481909 CEST	50018	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.786675930 CEST	22781	50017	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.787282944 CEST	22781	50018	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:49.787333965 CEST	50018	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.851553917 CEST	50018	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:49.856333971 CEST	22781	50018	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:50.394187927 CEST	22781	50018	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:50.394471884 CEST	50018	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:54.930239916 CEST	50018	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:54.932698965 CEST	50019	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:54.935113907 CEST	22781	50018	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:54.937534094 CEST	22781	50019	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:54.937681913 CEST	50019	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:55.030759096 CEST	50019	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:55.035531998 CEST	22781	50019	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:55.289849997 CEST	50019	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:09:55.297247887 CEST	22781	50019	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:55.533768892 CEST	22781	50019	167.71.56.116	192.168.2.7
Oct 18, 2024 14:09:55.533833981 CEST	50019	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:00.352444887 CEST	50019	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:00.357409954 CEST	22781	50019	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:00.357465982 CEST	50020	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:00.362287045 CEST	22781	50020	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:00.362366915 CEST	50020	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:00.432243109 CEST	50020	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:00.437050104 CEST	22781	50020	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:00.789944887 CEST	50020	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:00.794847965 CEST	22781	50020	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:00.959506035 CEST	22781	50020	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:00.959755898 CEST	50020	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:05.836426020 CEST	50020	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:05.839724064 CEST	50021	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:05.841264963 CEST	22781	50020	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:05.844607115 CEST	22781	50021	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:05.844727039 CEST	50021	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:06.029803038 CEST	50021	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:06.034987926 CEST	22781	50021	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:06.432492018 CEST	22781	50021	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:06.432574034 CEST	50021	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.315515041 CEST	50021	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.317900896 CEST	50022	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.320324898 CEST	22781	50021	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:11.322726965 CEST	22781	50022	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:11.322809935 CEST	50022	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.405093908 CEST	50022	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.410057068 CEST	22781	50022	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:11.912229061 CEST	22781	50022	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:11.912312031 CEST	50022	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.912414074 CEST	50022	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.913923025 CEST	50023	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.917220116 CEST	22781	50022	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:11.918725014 CEST	22781	50023	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:11.918797016 CEST	50023	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.946582079 CEST	50023	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:11.951451063 CEST	22781	50023	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:12.510632992 CEST	22781	50023	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:12.510710955 CEST	50023	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:32.040158987 CEST	50023	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:32.042043924 CEST	50035	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:32.045203924 CEST	22781	50023	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:32.047333956 CEST	22781	50035	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:32.047422886 CEST	50035	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:32.096044064 CEST	50035	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:32.100893974 CEST	22781	50035	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:32.639133930 CEST	22781	50035	167.71.56.116	192.168.2.7
Oct 18, 2024 14:10:32.639329910 CEST	50035	22781	192.168.2.7	167.71.56.116
Oct 18, 2024 14:10:32.754971027 CEST	50035	22781	192.168.2.7	167.71.56.116

Target ID:	0
Start time:	08:07:26
Start date:	18/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe"
Imagebase:	0x720000
File size:	2'121'456 bytes
MD5 hash:	09289584ED12A81A0A2A2D6DF31DF6DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000003.1286439675.000000007EBE0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:07:26
Start date:	18/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000001.00000002.3131831968.0000000000E02000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:18:21
Start date:	18/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1828
Imagebase:	0xe20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	61
Total number of Limit Nodes:	9

Executed Functions

Function 012256B8 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V.m, xrefs: 0122596F

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID:
String ID: \V.m
API String ID: 0-4037683661
Opcode ID: 8e9439c87f7eb18f7a8e27b20fd58ad27bf6371eea648c1b9e6ea87a2f84fd7e
Instruction ID: 0483cef14334627cee7b3eba1f09dfec71b666414156d7852e37de698da0cdd1
Opcode Fuzzy Hash: 8e9439c87f7eb18f7a8e27b20fd58ad27bf6371eea648c1b9e6ea87a2f84fd7e
Instruction Fuzzy Hash: 26B13F70E10259DFDB14CFA9C8857EDBBF2AF48314F24C129D915E7294EB749845CB81

Function 01228390 Relevance: .3, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e707955c5b4cdfd7ff65b12199aebab42c18b1a7d3babc98f13503ac1b0ddf
Instruction ID: c8b4f5629fa480b43784f573b3ecd680720126f9849f4e37125ec33d9edd8921
Opcode Fuzzy Hash: 18e707955c5b4cdfd7ff65b12199aebab42c18b1a7d3babc98f13503ac1b0ddf
Instruction Fuzzy Hash: 75C1B478F1422ADBDF284F6995542BDBEF2BFC8300F684419D982B6248CB39C851DB65

Function 01225F88 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ad933b8d699351e51baaa10d7e88b381dd09ee074bfe901e2bec23bce32db2
Instruction ID: 0e7c192a267aabc82f79fa6591804374613dca661095c4b6283ffa4f3610873c
Opcode Fuzzy Hash: 55ad933b8d699351e51baaa10d7e88b381dd09ee074bfe901e2bec23bce32db2
Instruction Fuzzy Hash: 1FB18071E102299FDF14CFA8C88579DBBF2BF89314F248229D914A7394EB749845CB81

Function 01227FA0 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182e18151ad84b1d02477a53001e07814009be6999f0142ef16df9e347544543
Instruction ID: 1b97789fc8db68ad05a925e7fc428cc8a4cec5beb6feeecc09a4a78480a9bd05
Opcode Fuzzy Hash: 182e18151ad84b1d02477a53001e07814009be6999f0142ef16df9e347544543
Instruction Fuzzy Hash: 50412232E1435A9FDB14DF79C8007AEBBF5EF89220F14856AD508E7250EB78A841CBD0

Function 01227999 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,01227FF2), ref: 012280DF

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c01202eaab2a68ee549950e9ad1417895b6357090564e6ee4e4b2e4b85b6743a
Instruction ID: 8b12a0c3077c0ad96bf72b6780a50046a1ef8f2b121d3a175f2179bc894850c6
Opcode Fuzzy Hash: c01202eaab2a68ee549950e9ad1417895b6357090564e6ee4e4b2e4b85b6743a
Instruction Fuzzy Hash: 2D2127B1C1066A9FCB20DF9AC444B9EFBF4FF48324F14816AD858A7240D778A945CFA5

Function 0122792C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,01227FF2), ref: 012280DF

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 19647f51164e94d76c266b5381e922b3715edac98451612ea757207acbd6c6a9
Instruction ID: ef4588aa9bfe23e1a9bcc53367e92920055309dedc82147ea80821db9dadba71
Opcode Fuzzy Hash: 19647f51164e94d76c266b5381e922b3715edac98451612ea757207acbd6c6a9
Instruction Fuzzy Hash: CE1117B1C1065A9BDB20DF9AC445BEEFBF4EB48310F10816AD918A7240D778A945CFA5

Non-executed Functions

Function 01225370 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V.m, xrefs: 012255BB

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID:
String ID: \V.m
API String ID: 0-4037683661
Opcode ID: 07ef574127e85001189405411e4208a2814162b9f4f140dcafc788632845074d
Instruction ID: cb6b86524d26578ae2a4d6a0ab5e530ea4f25b59d609b1b6613b163481a7aa98
Opcode Fuzzy Hash: 07ef574127e85001189405411e4208a2814162b9f4f140dcafc788632845074d
Instruction Fuzzy Hash: 63917E70E10319AFDB24CFA9D8817EDBBF2AF88314F14C129E505EB254DB749845CB81

Function 01220BA0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3132628123.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1220000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee37840a3042cd6f5a7a98461e4a92dbdc8836ea344621e6eefa2106cce96f60
Instruction ID: 7114faa299c6bb267a5eed168fdca7551df4fcbfa513be67eb671c1fefd66c95
Opcode Fuzzy Hash: ee37840a3042cd6f5a7a98461e4a92dbdc8836ea344621e6eefa2106cce96f60
Instruction Fuzzy Hash: A3818175F102189BDB28AF74885477E7AB6BFC8700B05892DF546E7388CE39C8428795

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_9be59e14b6b73c7898b15b8fa4185e5466451f4_38d14e40_eaf77835-1e61-4326-8852-8f37b184aff2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE53E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE697.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6B7.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Windows Analysis Report
SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe

Function 012256B8 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Function 01228390 Relevance: .3, Instructions: 332
COMMON

Function 01225F88 Relevance: .3, Instructions: 266
COMMON

Function 01227FA0 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Function 01227999 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 0122792C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON