Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe
Analysis ID:	1538162
MD5:	5219070f480d13acc2c7f195d0cc2ce0
SHA1:	333cbb9b6dc707e1c5cec3d9b4f8b92ef3331c4e
SHA256:	e200874f8b157dee0137b88d2773dd4666f56acd558a7bb453dbc72e95605b9c
Tags:	exe
Infos:

Detection

SheetRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected SheetRat

.NET source code contains potential unpacker

AI detected suspicious sample

Allows loading of unsigned dll using appinit_dll

Contains functionality to capture screen (.Net source)

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Drops large PE files

Machine Learning detection for sample

Modifies the windows firewall

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion NT Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe (PID: 3320 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe" MD5: 5219070F480D13ACC2C7F195D0CC2CE0)

WmiPrvSE.exe (PID: 5548 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 2836 cmdline: "CMD" netsh advfirewall firewall add rule name=",`f @A"X@f_J@M" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6928 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5672 cmdline: schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 2568 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7160 cmdline: schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST MD5: 76CD6626DD8834BD4A42E6A565104DC2)

xdwdDRkernel.exe (PID: 5780 cmdline: "C:\Windows\System32\xdwdDRkernel.exe" MD5: DAB505417386641EDA6647664B05B461)

xdwdDRkernel.exe (PID: 344 cmdline: C:\Windows\System32\xdwdDRkernel.exe MD5: DAB505417386641EDA6647664B05B461)

xdwdgrwMedia.exe (PID: 5852 cmdline: C:\Windows\Scenarios\xdwdgrwMedia.exe MD5: 55D55E337345200FE48FDCA4C7F21BC1)

xdwdDRkernel.exe (PID: 1908 cmdline: C:\Windows\System32\xdwdDRkernel.exe MD5: DAB505417386641EDA6647664B05B461)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1852045554.0000000013961000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe PID: 3320	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe.13983b30.0.raw.unpack	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe.13983b30.0.unpack	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit, CommandLine: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, ParentProcessId: 3320, ParentProcessName: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, ProcessCommandLine: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit, ProcessId: 6928, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\System32\userinit.exe,C:\Windows\System32\xdwdDRkernel.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, ProcessId: 3320, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Windows\System32\xdwdDRkernel.exe

Avira: detection malicious, Label: TR/Crypt.OPACK.Gen

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Malware\Desktop\hack tool\Backdoor\SheetRat\SheetRat\bin\Release\Stub\UserMode.pdb source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1852045554.0000000013961000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 147.185.221.21:51965

Source: Joe Sandbox View

IP Address: 147.185.221.21 147.185.221.21

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ships-florist.gl.at.ply.gg

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1841482183.0000000003931000.00000004.00000800.00020000.00000000.sdmp, xdwdDRkernel.exe, 0000000B.00000002.2895757862.0000000003AA1000.00000004.00000800.00020000.00000000.sdmp, xdwdgrwMedia.exe, 0000000D.00000002.1867424029.0000000003036000.00000004.00000800.00020000.00000000.sdmp, xdwdDRkernel.exe, 00000010.00000002.2365913464.0000000003499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: xdwdDRkernel.exe, 0000000A.00000002.1866718861.0000000003AF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1854489683.000000001E2C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1854489683.000000001E2C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	String found in binary or memory: https://www.entrust.net/rpa0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, Methods.cs	.Net Code: CaptureResizeReduceQuality
Source: xdwdDRkernel.exe.0.dr, Methods.cs	.Net Code: CaptureResizeReduceQuality

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

File dump: xdwdDRkernel.exe.0.dr 737630248

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Code function: 0_2_00007FFD9B788B9E NtProtectVirtualMemory,	0_2_00007FFD9B788B9E
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 10_2_00007FFD9B778B9E NtProtectVirtualMemory,	10_2_00007FFD9B778B9E
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B788B9E NtProtectVirtualMemory,	11_2_00007FFD9B788B9E
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Code function: 13_2_00007FFD9B758B9E NtProtectVirtualMemory,	13_2_00007FFD9B758B9E
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 16_2_00007FFD9B788B9E NtProtectVirtualMemory,	16_2_00007FFD9B788B9E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File created: C:\Windows\System32\xdwdDRkernel.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File created: C:\Windows\Scenarios	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File created: C:\Windows\Scenarios\xdwdgrwMedia.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File created: C:\Windows\xdwd.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Code function: 0_2_00007FFD9B784EF6	0_2_00007FFD9B784EF6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Code function: 0_2_00007FFD9B788510	0_2_00007FFD9B788510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Code function: 0_2_00007FFD9B785CA2	0_2_00007FFD9B785CA2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Code function: 0_2_00007FFD9B7884FD	0_2_00007FFD9B7884FD
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 10_2_00007FFD9B774EF6	10_2_00007FFD9B774EF6
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 10_2_00007FFD9B778510	10_2_00007FFD9B778510
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 10_2_00007FFD9B775CA2	10_2_00007FFD9B775CA2
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 10_2_00007FFD9B7784FD	10_2_00007FFD9B7784FD
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B784EF6	11_2_00007FFD9B784EF6
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B788510	11_2_00007FFD9B788510
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B785CA2	11_2_00007FFD9B785CA2
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B7884FD	11_2_00007FFD9B7884FD
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Code function: 13_2_00007FFD9B754EF6	13_2_00007FFD9B754EF6
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Code function: 13_2_00007FFD9B758510	13_2_00007FFD9B758510
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Code function: 13_2_00007FFD9B755CA2	13_2_00007FFD9B755CA2
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Code function: 13_2_00007FFD9B7584FD	13_2_00007FFD9B7584FD
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 16_2_00007FFD9B784EF6	16_2_00007FFD9B784EF6
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 16_2_00007FFD9B788510	16_2_00007FFD9B788510
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 16_2_00007FFD9B785CA2	16_2_00007FFD9B785CA2
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 16_2_00007FFD9B7884FD	16_2_00007FFD9B7884FD

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Static PE information: invalid certificate

Source: xdwdDRkernel.exe.0.dr	Static PE information: No import functions for PE file found
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1854820521.000000001E303000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000000.1649046167.0000000000560000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename. vs SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Binary or memory string: OriginalFilename. vs SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: xdwdDRkernel.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xdwdDRkernel.exe.0.dr, SecrityHidden.cs	Security API names: File.GetAccessControl
Source: xdwdDRkernel.exe.0.dr, SecrityHidden.cs	Security API names: File.SetAccessControl
Source: xdwdDRkernel.exe.0.dr, SecrityHidden.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, SecrityHidden.cs	Security API names: File.GetAccessControl
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, SecrityHidden.cs	Security API names: File.SetAccessControl
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, SecrityHidden.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: xdwdDRkernel.exe.0.dr, Config.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: xdwdDRkernel.exe.0.dr, Config.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, Config.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, Config.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/3@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe.log

Jump to behavior

Source: C:\Windows\System32\xdwdDRkernel.exe	Mutant created: NULL
Source: C:\Windows\System32\xdwdDRkernel.exe	Mutant created: \Sessions\1\BaseNamedObjects\ydkmzmj(c(yjjtg7m_ya3b&!iwa*
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_03

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name=",`f @A"X@f_J@M" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST
Source: unknown	Process created: C:\Windows\System32\xdwdDRkernel.exe C:\Windows\System32\xdwdDRkernel.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\xdwdDRkernel.exe "C:\Windows\System32\xdwdDRkernel.exe"
Source: unknown	Process created: C:\Windows\Scenarios\xdwdgrwMedia.exe C:\Windows\Scenarios\xdwdgrwMedia.exe
Source: unknown	Process created: C:\Windows\System32\xdwdDRkernel.exe C:\Windows\System32\xdwdDRkernel.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name=",`f @A"X@f_J@M" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\xdwdDRkernel.exe "C:\Windows\System32\xdwdDRkernel.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, PluginLoader.cs	.Net Code: Load System.AppDomain.Load(byte[])
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, PluginLoader.cs	.Net Code: Load
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, AsmiAndETW.cs	.Net Code: AggresivAmsiActivate System.Reflection.Assembly.Load(byte[])
Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, Updater.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: xdwdDRkernel.exe.0.dr, PluginLoader.cs	.Net Code: Load System.AppDomain.Load(byte[])
Source: xdwdDRkernel.exe.0.dr, PluginLoader.cs	.Net Code: Load
Source: xdwdDRkernel.exe.0.dr, AsmiAndETW.cs	.Net Code: AggresivAmsiActivate System.Reflection.Assembly.Load(byte[])
Source: xdwdDRkernel.exe.0.dr, Updater.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Code function: 0_2_00007FFD9B7800BD pushad ; iretd	0_2_00007FFD9B7800C1
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 10_2_00007FFD9B7700BD pushad ; iretd	10_2_00007FFD9B7700C1
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B7800BD pushad ; iretd	11_2_00007FFD9B7800C1
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B789E41 push ss; retf	11_2_00007FFD9B789E1F
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 11_2_00007FFD9B789DD6 push ss; retf	11_2_00007FFD9B789E1F
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Code function: 13_2_00007FFD9B7500BD pushad ; iretd	13_2_00007FFD9B7500C1
Source: C:\Windows\System32\xdwdDRkernel.exe	Code function: 16_2_00007FFD9B7800BD pushad ; iretd	16_2_00007FFD9B7800C1

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Static PE information: section name: .text entropy: 7.7538884297444755
Source: xdwdDRkernel.exe.0.dr	Static PE information: section name: .text entropy: 7.7538884297444755

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Executable created and started: C:\Windows\System32\xdwdDRkernel.exe			Jump to behavior
Source: unknown	Executable created and started: C:\Windows\Scenarios\xdwdgrwMedia.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

File created: C:\Windows\System32\xdwdDRkernel.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

File created: C:\Windows\System32\xdwdDRkernel.exe

Jump to dropped file

Boot Survival

Allows loading of unsigned dll using appinit_dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Registry value created: RequireSignedAppInit_DLLs 0

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows LoadAppInit_DLLs	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Memory allocated: ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Memory allocated: 1B930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Memory allocated: 1BAE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Memory allocated: 1450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Memory allocated: 1BAA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Memory allocated: E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Memory allocated: 1B020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Memory allocated: D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Memory allocated: 1B460000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe TID: 1396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe TID: 4484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe TID: 4940	Thread sleep count: 161 > 30	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe TID: 2676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\xdwdDRkernel.exe	Last function: Thread delayed
Source: C:\Windows\System32\xdwdDRkernel.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: xdwdDRkernel.exe, 0000000B.00000002.2900965280.000000001D160000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAWur%SystemRoot%\system32\mswsock.dll0a3a"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name=",`f @A"X@f_J@M" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Process created: C:\Windows\System32\xdwdDRkernel.exe "C:\Windows\System32\xdwdDRkernel.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Queries volume information: C:\Windows\System32\xdwdDRkernel.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Queries volume information: C:\Windows\System32\xdwdDRkernel.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	Queries volume information: C:\Windows\Scenarios\xdwdgrwMedia.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\xdwdDRkernel.exe	Queries volume information: C:\Windows\System32\xdwdDRkernel.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name=",`f @A"X@f_J@M" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit

Source: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1838209943.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, xdwdDRkernel.exe, 0000000A.00000002.1863508154.0000000001660000.00000004.00000020.00020000.00000000.sdmp, xdwdDRkernel.exe, 0000000A.00000002.1866169655.000000000166E000.00000004.00000020.00020000.00000000.sdmp, xdwdDRkernel.exe, 0000000B.00000002.2894747091.0000000001321000.00000004.00000020.00020000.00000000.sdmp, xdwdgrwMedia.exe, 0000000D.00000002.1866025596.00000000009C2000.00000004.00000020.00020000.00000000.sdmp, xdwdDRkernel.exe, 00000010.00000002.2365241575.0000000000E98000.00000004.00000020.00020000.00000000.sdmp, xdwdDRkernel.exe, 00000010.00000002.2365241575.0000000000E30000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Scenarios\xdwdgrwMedia.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\xdwdDRkernel.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected SheetRat

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe.13983b30.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe.13983b30.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1852045554.0000000013961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe PID: 3320, type: MEMORYSTR

Remote Access Functionality

Yara detected SheetRat

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe.13983b30.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe.13983b30.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1852045554.0000000013961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe PID: 3320, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	121 Masquerading	OS Credential Dumping	331 Security Software Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	341 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	341 Virtualization/Sandbox Evasion	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	213 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\System32\xdwdDRkernel.exe	100%	Avira	TR/Crypt.OPACK.Gen

Source	Detection	Scanner	Label
http://aia.entrust.net/ts1-chain256.cer01	0%	URL Reputation	safe
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://aka.ms/Vh5j3k	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ships-florist.gl.at.ply.gg	147.185.221.21	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://aia.entrust.net/ts1-chain256.cer01	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0	xdwdDRkernel.exe, 0000000A.00000002.1866718861.0000000003AF6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/ts1ca.crl0	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1841482183.0000000003931000.00000004.00000800.00020000.00000000.sdmp, xdwdDRkernel.exe, 0000000B.00000002.2895757862.0000000003AA1000.00000004.00000800.00020000.00000000.sdmp, xdwdgrwMedia.exe, 0000000D.00000002.1867424029.0000000003036000.00000004.00000800.00020000.00000000.sdmp, xdwdDRkernel.exe, 00000010.00000002.2365913464.0000000003499000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa03	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	false	URL Reputation: safe	unknown
https://aka.ms/Vh5j3k	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1854489683.000000001E2C6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, xdwdDRkernel.exe.0.dr	false	URL Reputation: safe	unknown
https://aka.ms/odirm	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe, 00000000.00000002.1854489683.000000001E2C6000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.21	ships-florist.gl.at.ply.gg	United States		12087	SALSGIVERUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538162
Start date and time:	2024-10-20 17:35:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/3@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 21 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Simulations

Behavior and APIs

Time	Type	Description
16:36:07	Task Scheduler	Run new task: CrashReporter_NvTew path: C:\Windows\System32\xdwdDRkernel.exe
16:36:09	Task Scheduler	Run new task: MachineCoreGoogleUpdateTor path: C:\Windows\Scenarios\xdwdgrwMedia.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.21	mIURiU8n2P.exe	Get hash	malicious	XWorm	Browse
	PixpFUv4G7.exe	Get hash	malicious	Quasar, XWorm	Browse
	r4RF3TX5Mi.exe	Get hash	malicious	XWorm	Browse
	ra66DSpa.exe	Get hash	malicious	XWorm	Browse
	Q5N7WOpk8J.bat	Get hash	malicious	Unknown	Browse
	NzEsfIiAc0.exe	Get hash	malicious	XWorm	Browse
	Y666Gn09a1.exe	Get hash	malicious	XWorm	Browse
	Uhj9qfwbYG.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	WIN CHANGER 2.3.exe	Get hash	malicious	XWorm	Browse
	jj7svxNeaQ.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	gPEbJi1xiY.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	lx3vLwrX57.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	arm7.elf	Get hash	malicious	Unknown	Browse	147.168.93.87
	file.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.20
	arm7.elf	Get hash	malicious	Unknown	Browse	147.168.203.92
	MjrlHJvNyq.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	r8k29DBraE.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	SpeedHack666Cheat (no VM detected).exe	Get hash	malicious	Njrat, RevengeRAT	Browse	147.185.221.23
	mIURiU8n2P.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	147.185.221.23

Process:	C:\Windows\System32\xdwdDRkernel.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.349816875832946
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1WzAbDLI4MNepQZaOKbbDLI4MWuPOKfSSI6Khav:ML9E4KQMsXE4NpOKDE4KGKZI6Khk
MD5:	CE2C9B879749D2DDE6CEE82813F4ED9D
SHA1:	45614E9485EF4EEAD572387D9DD69480D1C79888
SHA-256:	8F7CD246CA33FC6FF7ED3C425842EEC6433FCDA26F4603C26C3A498273AE83CB
SHA-512:	5AB487F6AE9F2E749114FE50DB1EF9FB181B3B0968C92AA787362C59788376FF50F6411ECFAE835CD1001B68E9B1961398A695AB16D5412F09E49A44A769F5EE
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdgrwMedia.exe.log

Download File

Process:	C:\Windows\Scenarios\xdwdgrwMedia.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.349816875832946
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1WzAbDLI4MNepQZaOKbbDLI4MWuPOKfSSI6Khav:ML9E4KQMsXE4NpOKDE4KGKZI6Khk
MD5:	CE2C9B879749D2DDE6CEE82813F4ED9D
SHA1:	45614E9485EF4EEAD572387D9DD69480D1C79888
SHA-256:	8F7CD246CA33FC6FF7ED3C425842EEC6433FCDA26F4603C26C3A498273AE83CB
SHA-512:	5AB487F6AE9F2E749114FE50DB1EF9FB181B3B0968C92AA787362C59788376FF50F6411ECFAE835CD1001B68E9B1961398A695AB16D5412F09E49A44A769F5EE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Windows\System32\xdwdDRkernel.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	737630248
Entropy (8bit):	0.010686776300131142
Encrypted:	false
SSDEEP:
MD5:	DAB505417386641EDA6647664B05B461
SHA1:	904B6A96404A243EABF27015BDFF2F25E5F21BDD
SHA-256:	AFF05B82ED6192011AD2F3FF2AE04221C6AA2FFCE86E6B78B067068DEBD1739D
SHA-512:	EDDC154251A36FF654EFD9B88F6E32F39F050E994BBF6CACCAE32B7D36206EB4624ED95304C82E9CA7887AF9535D9F9C356613ADEEC10C1A21E7D9B9DA9371DF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a..f.........."...0......d........... .....@..... ....................................@...@......@............... ...................................b...........2..(&........................................................................... ..H............text...,.... ...................... ..`.rsrc....b.......d..................@..@........................................H............`...... ....e...$...........................................W.......4...f.2..W.....H3......3.........(!...J.($....o%...(....6..(&...o...."..o....F($....(....o0...2.o....(1...".o......sD.........(%...-#(&...-.($...-.('...-.((...-.(...,..(K....r3..p(j...sL...sM...(N...oO.......rs..p(j...sL...sM...(N...oO.......s-.............n.r=..p(j...rQ..p(j...(2...b.{%....o<...(v....ow...2~.....o.......}+.....}.....{....8...}(.....}).......C...s....s.....{(...(.....

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.716386309664472
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe
File size:	481'320 bytes
MD5:	5219070f480d13acc2c7f195d0cc2ce0
SHA1:	333cbb9b6dc707e1c5cec3d9b4f8b92ef3331c4e
SHA256:	e200874f8b157dee0137b88d2773dd4666f56acd558a7bb453dbc72e95605b9c
SHA512:	5549fc0d454cb898fb2e089b1247e0196898c18e2299b87052d16053629afb9807c2512abe9b6875cc158bd17ba5ee132b657058f1fc97b5c8d7763c3f8d2924
SSDEEP:	6144:RefGRHh9jUIsWRZovT3ST4sbs4ebd89sX0ChUp1hsJ8EH:sfGBbjUeRZoLSUCN6vUp1a+EH
TLSH:	5BA429B28B831DB3D4C2E2BB3F0501DA9998AA4325FD015B617DF66EC26D6585343E0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a..f.........."...0......d........... .....@..... ....................................@...@......@............... .....

File Icon


Icon Hash:	0f6955a88855290f

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CCF161 [Mon Aug 26 21:19:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	26/02/2022 00:00:00 01/03/2023 23:59:59
Subject Chain	CN=Nvidia Corporation, OU=IT-MIS, O=Nvidia Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	1CCB73FCDB6A7BE7C04978F53E40695A
Thumbprint SHA-1:	CA0F1595C0C349C003D41743460E448E887F9477
Thumbprint SHA-256:	1E56D8CFAE4119883632D8FD6E1E3ACDF16CDDAB9621FCA4D6CFFB1A663E74D1
Serial:	0800EE4ED1A959CC9887E905AD662BFE

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x30000	0x4620c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x73200	0x2628	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2cb2c	0x2cc00	7692a5e86ecb764bcc92bf6f0ae274f5	False	0.88294343575419	data	7.7538884297444755	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x30000	0x4620c	0x46400	0a3c5de5f63ddfb385dd703e5147abd8	False	0.16322842526690393	data	5.544214903643953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x301c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.6480496453900709
RT_ICON	0x30628	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4376172607879925
RT_ICON	0x316d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.35892116182572614
RT_ICON	0x33c78	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	0.1473170695623872
RT_GROUP_ICON	0x75ca0	0x3e	data	0.7580645161290323
RT_VERSION	0x75ce0	0x340	data	0.43990384615384615
RT_MANIFEST	0x76020	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 17:36:12.634309053 CEST	49734	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:12.639552116 CEST	51965	49734	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:12.639621973 CEST	49734	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:12.776011944 CEST	49734	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:12.780859947 CEST	51965	49734	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:20.288965940 CEST	51965	49734	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:20.289031982 CEST	49734	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:20.504091024 CEST	49734	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:20.504951000 CEST	49742	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:20.509044886 CEST	51965	49734	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:20.509789944 CEST	51965	49742	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:20.509968996 CEST	49742	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:20.510272980 CEST	49742	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:20.515115023 CEST	51965	49742	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:28.120836973 CEST	51965	49742	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:28.121068954 CEST	49742	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:28.331571102 CEST	49742	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:28.332695007 CEST	49747	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:28.336704969 CEST	51965	49742	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:28.337675095 CEST	51965	49747	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:28.337749004 CEST	49747	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:28.338041067 CEST	49747	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:28.342776060 CEST	51965	49747	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:35.943000078 CEST	51965	49747	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:35.943269968 CEST	49747	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:36.159586906 CEST	49747	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:36.160435915 CEST	49748	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:36.164381027 CEST	51965	49747	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:36.165262938 CEST	51965	49748	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:36.165348053 CEST	49748	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:36.171225071 CEST	49748	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:36.176045895 CEST	51965	49748	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:43.774478912 CEST	51965	49748	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:43.774596930 CEST	49748	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:43.987988949 CEST	49748	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:43.989671946 CEST	49749	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:43.992870092 CEST	51965	49748	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:43.994508982 CEST	51965	49749	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:43.994599104 CEST	49749	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:43.995342970 CEST	49749	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:44.000442982 CEST	51965	49749	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:51.608449936 CEST	51965	49749	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:51.608549118 CEST	49749	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:51.815913916 CEST	49749	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:51.816845894 CEST	49750	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:51.821229935 CEST	51965	49749	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:51.821803093 CEST	51965	49750	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:51.821888924 CEST	49750	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:51.822141886 CEST	49750	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:51.827009916 CEST	51965	49750	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:59.448327065 CEST	51965	49750	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:59.448388100 CEST	49750	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:59.659603119 CEST	49750	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:59.660358906 CEST	49775	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:59.664525986 CEST	51965	49750	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:59.665271044 CEST	51965	49775	147.185.221.21	192.168.2.4
Oct 20, 2024 17:36:59.665334940 CEST	49775	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:59.665545940 CEST	49775	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:36:59.670514107 CEST	51965	49775	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:07.288518906 CEST	51965	49775	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:07.290239096 CEST	49775	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:07.503489017 CEST	49775	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:07.504504919 CEST	49809	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:07.508291006 CEST	51965	49775	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:07.509475946 CEST	51965	49809	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:07.509547949 CEST	49809	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:07.509814024 CEST	49809	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:07.515062094 CEST	51965	49809	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:15.126517057 CEST	51965	49809	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:15.126583099 CEST	49809	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:15.331713915 CEST	49809	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:15.332813025 CEST	49849	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:15.336679935 CEST	51965	49809	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:15.337739944 CEST	51965	49849	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:15.337809086 CEST	49849	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:15.338062048 CEST	49849	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:15.342832088 CEST	51965	49849	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:22.950733900 CEST	51965	49849	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:22.950939894 CEST	49849	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:23.159801006 CEST	49849	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:23.160541058 CEST	49882	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:23.165294886 CEST	51965	49849	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:23.166261911 CEST	51965	49882	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:23.166318893 CEST	49882	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:23.166548014 CEST	49882	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:23.171319008 CEST	51965	49882	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:30.791578054 CEST	51965	49882	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:30.791647911 CEST	49882	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:31.003467083 CEST	49882	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:31.004232883 CEST	49915	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:31.008363008 CEST	51965	49882	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:31.009083986 CEST	51965	49915	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:31.009146929 CEST	49915	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:31.009373903 CEST	49915	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:31.014182091 CEST	51965	49915	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:38.614792109 CEST	51965	49915	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:38.614962101 CEST	49915	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:38.816013098 CEST	49915	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:38.817079067 CEST	49946	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:38.821099997 CEST	51965	49915	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:38.822165012 CEST	51965	49946	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:38.822235107 CEST	49946	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:38.822715044 CEST	49946	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:38.827660084 CEST	51965	49946	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:46.439300060 CEST	51965	49946	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:46.439369917 CEST	49946	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:46.644418001 CEST	49946	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:46.645440102 CEST	49980	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:46.649548054 CEST	51965	49946	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:46.650468111 CEST	51965	49980	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:46.650542021 CEST	49980	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:46.650840044 CEST	49980	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:46.656346083 CEST	51965	49980	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:54.280622005 CEST	51965	49980	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:54.280688047 CEST	49980	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:54.487946033 CEST	49980	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:54.488917112 CEST	50015	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:54.493721008 CEST	51965	49980	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:54.495568991 CEST	51965	50015	147.185.221.21	192.168.2.4
Oct 20, 2024 17:37:54.495650053 CEST	50015	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:54.495897055 CEST	50015	51965	192.168.2.4	147.185.221.21
Oct 20, 2024 17:37:54.501622915 CEST	51965	50015	147.185.221.21	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 17:36:12.591021061 CEST	57208	53	192.168.2.4	1.1.1.1
Oct 20, 2024 17:36:12.605979919 CEST	53	57208	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 17:36:12.591021061 CEST	192.168.2.4	1.1.1.1	0x9eed	Standard query (0)	ships-florist.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 17:36:12.605979919 CEST	1.1.1.1	192.168.2.4	0x9eed	No error (0)	ships-florist.gl.at.ply.gg		147.185.221.21	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:35:52
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe"
Imagebase:	0x530000
File size:	481'320 bytes
MD5 hash:	5219070F480D13ACC2C7F195D0CC2CE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SheetRat, Description: Yara detected SheetRat, Source: 00000000.00000002.1852045554.0000000013961000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:36:06
Start date:	20/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:36:06
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"CMD" netsh advfirewall firewall add rule name=",`f @A"X@f_J@M" dir=in action=allow program="C:\Windows\System32\xdwdDRkernel.exe" enable=yes & exit
Imagebase:	0x7ff716910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:36:06
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:36:06
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST & exit
Imagebase:	0x7ff716910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:36:07
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f330000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:36:07
Start date:	20/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc minute /mo 1 /tn "AppID\CrashReporter_NvTew" /tr "C:\Windows\System32\xdwdDRkernel.exe" /RL HIGHEST
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:36:07
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST & exit
Imagebase:	0x7ff716910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:36:07
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:36:07
Start date:	20/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc minute /mo 30 /tn "Maps\MachineCoreGoogleUpdateTor" /tr "C:\Windows\Scenarios\xdwdgrwMedia.exe" /RL HIGHEST
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:36:09
Start date:	20/10/2024
Path:	C:\Windows\System32\xdwdDRkernel.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\xdwdDRkernel.exe
Imagebase:	0xbe0000
File size:	737'630'248 bytes
MD5 hash:	DAB505417386641EDA6647664B05B461
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:36:10
Start date:	20/10/2024
Path:	C:\Windows\System32\xdwdDRkernel.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\xdwdDRkernel.exe"
Imagebase:	0xab0000
File size:	737'630'248 bytes
MD5 hash:	DAB505417386641EDA6647664B05B461
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:36:12
Start date:	20/10/2024
Path:	C:\Windows\Scenarios\xdwdgrwMedia.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Scenarios\xdwdgrwMedia.exe
Imagebase:	0xd0000
File size:	778'524'712 bytes
MD5 hash:	55D55E337345200FE48FDCA4C7F21BC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:37:03
Start date:	20/10/2024
Path:	C:\Windows\System32\xdwdDRkernel.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\xdwdDRkernel.exe
Imagebase:	0x4b0000
File size:	737'630'248 bytes
MD5 hash:	DAB505417386641EDA6647664B05B461
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	28%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B788B9E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFD9B788C94

Strings

U, xrefs: 00007FFD9B788BC9

Memory Dump Source

Source File: 00000000.00000002.1857656497.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b780000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: U
API String ID: 2706961497-3372436214
Opcode ID: fc1e2923c484f0d8d576e3c06bcf581d5b423679d513219abc675dcbd1891006
Instruction ID: 10816e4d83a0e454bc786405512427e28e27363375693bb2c427c7c48069d3f4
Opcode Fuzzy Hash: fc1e2923c484f0d8d576e3c06bcf581d5b423679d513219abc675dcbd1891006
Instruction Fuzzy Hash: E541D83090CB884FDB199B6898156E97FF1EB9A320F0442EFE489D7297CA755805CB92

Function 00007FFD9B7884FD Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 00007FFD9B78850A

Memory Dump Source

Source File: 00000000.00000002.1857656497.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b780000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 15b68a81ca4f55d7bc8b83df591b7794ad69ec869820d2b48aed5ce9d418b4e1
Instruction ID: 8c6e0af888cdc41a7380eb95e019fd351615dee77ba5d0681917fbeca8e85de8
Opcode Fuzzy Hash: 15b68a81ca4f55d7bc8b83df591b7794ad69ec869820d2b48aed5ce9d418b4e1
Instruction Fuzzy Hash: FE41F331E18A094BF72DEF6088A65FA73E1EF54315F84453ED49BD24EBED38B4068681

Function 00007FFD9B784EF6 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857656497.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b780000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6fadc58ec9e0cd52e97f879b0e0675a56a048aa52c0476bc4fbcf846c5d462
Instruction ID: f797149ba2e414acee85a9549902db2137237d5878696f3df2cf77c1db845db9
Opcode Fuzzy Hash: 7a6fadc58ec9e0cd52e97f879b0e0675a56a048aa52c0476bc4fbcf846c5d462
Instruction Fuzzy Hash: E7F1A430A09A4D4FEBA8DF28C8957E977E1FF54311F04426EE84DC72A5DB7899418B82

Function 00007FFD9B785CA2 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857656497.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b780000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990e73708e703711784314274472e40d8f6b80fb9d5d3a1a9ef7d2cfaa26f831
Instruction ID: cffe7760ea6164f8508b75694fc21139307659088370954ab2f47d1a7c65ab8a
Opcode Fuzzy Hash: 990e73708e703711784314274472e40d8f6b80fb9d5d3a1a9ef7d2cfaa26f831
Instruction Fuzzy Hash: E7E1B530A09E4D8FEBA8DF28C8957E977E1FF54311F04436AD84DC72A5DE7499418782

Function 00007FFD9B788510 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857656497.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b780000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e7b4d6137e99b8eef7abfdfa2ae16cead25225ca9b2b43a7fec486bee4bf8c
Instruction ID: e767eb2f4bd3260219cf447ab32652eb39ac76ddd2d1951ca1b6809572926445
Opcode Fuzzy Hash: 08e7b4d6137e99b8eef7abfdfa2ae16cead25225ca9b2b43a7fec486bee4bf8c
Instruction Fuzzy Hash: BEA12721F09E494BE71DAB788CAA5FA77D1EF95315F04417EE09BC31EBDD2864028281

Analysis Process: xdwdDRkernel.exePID: 344, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	22.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B778B9E Relevance: 1.7, APIs: 1, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFD9B778C94

Memory Dump Source

Source File: 0000000A.00000002.1881972059.00007FFD9B770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b770000_xdwdDRkernel.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 81b82173c89ffd6e0f00e5b973f4675110d5a40589ab83d19e9a7be40a2249d0
Instruction ID: d893a1ecdbe6a6bb6215bed1e1ddf4f70e57aad833fa41f8764d91fc86382ac6
Opcode Fuzzy Hash: 81b82173c89ffd6e0f00e5b973f4675110d5a40589ab83d19e9a7be40a2249d0
Instruction Fuzzy Hash: 01412B71A0D7884FDB599B6C98556E97FE1EF86320F0442AFE08DC72A3CE7568058782

Analysis Process: xdwdDRkernel.exePID: 5780, Parent PID: 3320COMMON

Execution Graph

Execution Coverage:	24.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B788B9E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFD9B788C94

Strings

U, xrefs: 00007FFD9B788BC9

Memory Dump Source

Source File: 0000000B.00000002.2902061905.00007FFD9B784000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B784000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b784000_xdwdDRkernel.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: U
API String ID: 2706961497-3372436214
Opcode ID: 3cb6ce66883eef50efb255582a58b17c08ba782d30fa9e175fbd1452832be908
Instruction ID: 10816e4d83a0e454bc786405512427e28e27363375693bb2c427c7c48069d3f4
Opcode Fuzzy Hash: 3cb6ce66883eef50efb255582a58b17c08ba782d30fa9e175fbd1452832be908
Instruction Fuzzy Hash: E541D83090CB884FDB199B6898156E97FF1EB9A320F0442EFE489D7297CA755805CB92

Function 00007FFD9B780F45 Relevance: 1.6, Strings: 1, Instructions: 377
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00007FFD9B780F5A

Memory Dump Source

Source File: 0000000B.00000002.2902061905.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 497890dd7e260c26ce6d6a00e10fdbdedfa8e449027621e2c8ba02bda08a9e66
Instruction ID: bf4e008dde5ecbcfccc5b4652ff2e8ea053111f75eeaf6f0ec5f034e3e91d86b
Opcode Fuzzy Hash: 497890dd7e260c26ce6d6a00e10fdbdedfa8e449027621e2c8ba02bda08a9e66
Instruction Fuzzy Hash: DBC10221F25D1E4BD698F7BC80B55BD71D2FF88202B8145B5E05EC36EAFE2CA9028754

Function 00007FFD9B780955 Relevance: 1.6, Strings: 1, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 00007FFD9B78096A

Memory Dump Source

Source File: 0000000B.00000002.2902061905.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 901fc7de652bd0f911c44e59ec684bb9fb5f0d0527f46219dafac6cd486dcda2
Instruction ID: 976cf9050a17fa1bbfb4259c5ce53f5f8c150b81b71abdf373ef81ae3eaedb3f
Opcode Fuzzy Hash: 901fc7de652bd0f911c44e59ec684bb9fb5f0d0527f46219dafac6cd486dcda2
Instruction Fuzzy Hash: 28B1A535B18A0A8FE798F76C84A5B69B3D2FF98705F5101B9E05DC32E6DE38B8418741

Function 00007FFD9B780745 Relevance: 1.4, Strings: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M_^, xrefs: 00007FFD9B780762

Memory Dump Source

Source File: 0000000B.00000002.2902061905.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID: M_^
API String ID: 0-921959145
Opcode ID: 4b3f7dbdf44fd4b8365c42cb43afcae6a7ca1429129519879304a4933091642a
Instruction ID: 1dd4a95d69a0a69f58d7be8b2da2d7c6015821499e48fe171e6a7ec83ce946ef
Opcode Fuzzy Hash: 4b3f7dbdf44fd4b8365c42cb43afcae6a7ca1429129519879304a4933091642a
Instruction Fuzzy Hash: F1512B52F0FBC65EEB2257B808B90E83F90FF12655B0942FBC0948A0F3ED286549C751

Function 00007FFD9B7827EC Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2902061905.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3591f1854efeaf390a0a95413103257e1b4a2822889e5ef37b456fcf5e2a3475
Instruction ID: 35a965a72a54ca26cf3c72176f57fabc81db2949bb446d5a4774efe66e150151
Opcode Fuzzy Hash: 3591f1854efeaf390a0a95413103257e1b4a2822889e5ef37b456fcf5e2a3475
Instruction Fuzzy Hash: FD519631D08B1C8FDB58DB58D855BE9BBF1FB59311F0082AAD44DE3252DE34A9858F81

Function 00007FFD9B780760 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2902061905.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12a7cec08318479f7877bd39869a6b217bd9da88c5cd26880bbdaf7524ea272
Instruction ID: 7ed8a89bf1c06eacaeee06c7f47d4a5cda8a5129854c5aa0efad6e975fb2626d
Opcode Fuzzy Hash: e12a7cec08318479f7877bd39869a6b217bd9da88c5cd26880bbdaf7524ea272
Instruction Fuzzy Hash: 89510C52F0FBC65FEB1267B818B90E87F90BF22655B0942FBD0948A0F3DD286945C745

Function 00007FFD9B780500 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2902061905.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc070b3ccba141fd05d1cb72e5bd350ed7a84c15ff47c9249ffea2d5d6028a5
Instruction ID: 6bb0c6c546bf7b688e8e0cd65d695f0093137464128c39a491bc45143f9c05b7
Opcode Fuzzy Hash: dfc070b3ccba141fd05d1cb72e5bd350ed7a84c15ff47c9249ffea2d5d6028a5
Instruction Fuzzy Hash:

Analysis Process: xdwdgrwMedia.exePID: 5852, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	20.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B758B9E Relevance: 1.7, APIs: 1, Instructions: 215
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFD9B758C94

Memory Dump Source

Source File: 0000000D.00000002.1883034038.00007FFD9B750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b750000_xdwdgrwMedia.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5d003a6fee32953949e3489992cf39d15a56c9a5b1acd82e791c5dc4297e3e68
Instruction ID: 72f8cdf4bc5ccaf5150bc82225d52f51ae7266cacff2f8061bad0c3cd42abf0b
Opcode Fuzzy Hash: 5d003a6fee32953949e3489992cf39d15a56c9a5b1acd82e791c5dc4297e3e68
Instruction Fuzzy Hash: DE512D71A0E7884FD75997AC98256A97FE1EF96320F0502FFD089C71E3CD656806C782

Analysis Process: xdwdDRkernel.exePID: 1908, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	22.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B788B9E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFD9B788C94

Strings

U, xrefs: 00007FFD9B788BC9

Memory Dump Source

Source File: 00000010.00000002.2370287682.00007FFD9B784000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B784000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b784000_xdwdDRkernel.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: U
API String ID: 2706961497-3372436214
Opcode ID: 3cb6ce66883eef50efb255582a58b17c08ba782d30fa9e175fbd1452832be908
Instruction ID: 10816e4d83a0e454bc786405512427e28e27363375693bb2c427c7c48069d3f4
Opcode Fuzzy Hash: 3cb6ce66883eef50efb255582a58b17c08ba782d30fa9e175fbd1452832be908
Instruction Fuzzy Hash: E541D83090CB884FDB199B6898156E97FF1EB9A320F0442EFE489D7297CA755805CB92

Function 00007FFD9B780F45 Relevance: 1.6, Strings: 1, Instructions: 377
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00007FFD9B780F5A

Memory Dump Source

Source File: 00000010.00000002.2370287682.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 234f9d60bbb89d5bf2ffb7e9069d08f862f3e11710fbb37f87045a14806ce3ef
Instruction ID: 2bb1fed5d685baef7c646fb6ec878bfbfcc24362c07929a1d1ecca2a47f79232
Opcode Fuzzy Hash: 234f9d60bbb89d5bf2ffb7e9069d08f862f3e11710fbb37f87045a14806ce3ef
Instruction Fuzzy Hash: C0C1D160F25D1E4BD798FBB844B5ABD61D2BF88605B8145F8E01ED36EAED2CAD018740

Function 00007FFD9B780955 Relevance: 1.6, Strings: 1, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 00007FFD9B78096A

Memory Dump Source

Source File: 00000010.00000002.2370287682.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: d3ff0e9a34deb6603f7b131be91b39783371b8a2a857268ed37fd38083dfdf1b
Instruction ID: 01866d1fa013fc0112953711403c86ba65101d23134f778a8b726adb6f607662
Opcode Fuzzy Hash: d3ff0e9a34deb6603f7b131be91b39783371b8a2a857268ed37fd38083dfdf1b
Instruction Fuzzy Hash: AEB19634B19A098FE798FB6884A5B69B3D2FF94705F5101B9E01DC36E6CE38F8418781

Function 00007FFD9B780745 Relevance: 1.4, Strings: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M_^, xrefs: 00007FFD9B780762

Memory Dump Source

Source File: 00000010.00000002.2370287682.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID: M_^
API String ID: 0-921959145
Opcode ID: 7664a4deaa732c5a914f8cbeef59a53abe008bbc1f0062c6c064c8e6a7002603
Instruction ID: c43a204d1d66273f80a2f698898a23fb2a0d2a6ce8da146676b14d1613228f9b
Opcode Fuzzy Hash: 7664a4deaa732c5a914f8cbeef59a53abe008bbc1f0062c6c064c8e6a7002603
Instruction Fuzzy Hash: 56512B52F0FBC65EEB2257B808B90E83F90FF12655B0942FBC0948A0F3ED286549C741

Function 00007FFD9B7827EC Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2370287682.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3591f1854efeaf390a0a95413103257e1b4a2822889e5ef37b456fcf5e2a3475
Instruction ID: 35a965a72a54ca26cf3c72176f57fabc81db2949bb446d5a4774efe66e150151
Opcode Fuzzy Hash: 3591f1854efeaf390a0a95413103257e1b4a2822889e5ef37b456fcf5e2a3475
Instruction Fuzzy Hash: FD519631D08B1C8FDB58DB58D855BE9BBF1FB59311F0082AAD44DE3252DE34A9858F81

Function 00007FFD9B780760 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2370287682.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 758d4dd29a2d4695c57c11e56dd1df37ffa0eb83ee8b2058d7a9253f44bea61e
Instruction ID: 30e81617dfb24a5a568cd2def02276fdec9eb81f179e69c236b2be141e3977e2
Opcode Fuzzy Hash: 758d4dd29a2d4695c57c11e56dd1df37ffa0eb83ee8b2058d7a9253f44bea61e
Instruction Fuzzy Hash: E9510C52F0FBC65FEB1267B818B90E87F90BF22655B0942FBD0A48A0F3DD286945C745

Function 00007FFD9B780500 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2370287682.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b780000_xdwdDRkernel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc070b3ccba141fd05d1cb72e5bd350ed7a84c15ff47c9249ffea2d5d6028a5
Instruction ID: 6bb0c6c546bf7b688e8e0cd65d695f0093137464128c39a491bc45143f9c05b7
Opcode Fuzzy Hash: dfc070b3ccba141fd05d1cb72e5bd350ed7a84c15ff47c9249ffea2d5d6028a5
Instruction Fuzzy Hash:

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdDRkernel.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdgrwMedia.exe.log

C:\Windows\System32\xdwdDRkernel.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Network Behavior

Network Port Distribution

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoad4.16832.13675.15683.exe

Function 00007FFD9B788B9E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
nativeCOMMON

Function 00007FFD9B7884FD Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Function 00007FFD9B778B9E Relevance: 1.7, APIs: 1, Instructions: 170
nativeCOMMON