Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe
Analysis ID:	1543710
MD5:	803d402767279864bebd70d810cc7461
SHA1:	faed2f5ec54739b4e751295b28a366ddc5902833
SHA256:	b8ee29a158040d128d74d25483b85d69f1125bf615e7862fec4cb5bd7e86aa47
Tags:	exe
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Detected potential crypto function

Entry point lies outside standard sections

Found potential string decryption / allocating functions

One or more processes crash

PE file contains sections with non-standard names

PE file does not import any functions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe (PID: 6668 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe" MD5: 803D402767279864BEBD70D810CC7461)

WerFault.exe (PID: 6844 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 232 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP, BYTES_REVERSED_HI

Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	String found in binary or memory: http://www.clamav.net
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	String found in binary or memory: http://www.pcnet123.cn
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	String found in binary or memory: http://www.pcnet123.cnOpenU

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0045B050	0_2_0045B050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0047B0D0	0_2_0047B0D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_004752F4	0_2_004752F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0045554C	0_2_0045554C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Code function: String function: 0040441C appears 87 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 232

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal64.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6668

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\31237557-8088-4f8d-aa31-4c1b8aef9af8

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 232

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Section loaded: apphelp.dll

Jump to behavior

Source: initial sample

Static PE information: section where entry point is pointing to: .clam01

Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam01
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam02
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam03
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam04
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam05
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam06
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam07
Source: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Static PE information: section name: .clam08

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0047E04C push 0047E078h; ret	0_2_0047E070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00468074 push 004680A0h; ret	0_2_00468098
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00456004 push 0045606Fh; ret	0_2_00456067
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0047E014 push 0047E040h; ret	0_2_0047E038
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00468010 push 00468036h; ret	0_2_0046802E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0040E0C4 push 0040E240h; ret	0_2_0040E238
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0047E084 push 0047E0B0h; ret	0_2_0047E0A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0047E0BC push 0047E0E8h; ret	0_2_0047E0E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0041E178 push ecx; mov dword ptr [esp], edx	0_2_0041E17A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0047E12C push 0047E158h; ret	0_2_0047E150
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_004841F8 push 00484224h; ret	0_2_0048421C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0044E1FC push 0044E228h; ret	0_2_0044E220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0047E184 push 0047E1B0h; ret	0_2_0047E1A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00498184 push 004981B0h; ret	0_2_004981A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0040E242 push 0040E2B3h; ret	0_2_0040E2AB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0040E244 push 0040E2B3h; ret	0_2_0040E2AB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0042A2C0 push 0042A390h; ret	0_2_0042A388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0040E322 push 0040E350h; ret	0_2_0040E348
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0040E324 push 0040E350h; ret	0_2_0040E348
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_004843D4 push 00484400h; ret	0_2_004843F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00464460 push ecx; mov dword ptr [esp], ecx	0_2_00464465
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00420438 push ecx; mov dword ptr [esp], edx	0_2_0042043D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_004664D8 push 0046651Bh; ret	0_2_00466513
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0042A4A0 push 0042A4CCh; ret	0_2_0042A4C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_004164B4 push ecx; mov dword ptr [esp], eax	0_2_004164B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0042C554 push 0042C595h; ret	0_2_0042C58D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00486538 push 00486564h; ret	0_2_0048655C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0046653C push 00466588h; ret	0_2_00466580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0042C5D8 push 0042C610h; ret	0_2_0042C608
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_00466594 push 004665C0h; ret	0_2_004665B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	Code function: 0_2_0042C5A0 push 0042C5CCh; ret	0_2_0042C5C4

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Code function: 0_2_00484230 rdtsc

0_2_00484230

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Code function: 0_2_00484230 rdtsc

0_2_00484230

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	31 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	34%	ReversingLabs
SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	100%	Avira	TR/Crypt.XPACK.Gen
SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.clamav.net	SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	false		unknown
http://upx.sf.net	Amcache.hve.3.dr	false	URL Reputation: safe	unknown
http://www.pcnet123.cnOpenU	SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	false		unknown
http://www.pcnet123.cn	SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543710
Start date and time:	2024-10-28 09:44:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe
Detection:	MAL
Classification:	mal64.winEXE@2/5@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Execution Graph export aborted for target SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe, PID 6668 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Simulations

Behavior and APIs

Time	Type	Description
04:45:18	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_4870883f729ecc58dcb48bcd2b1e52fb1f29697_5aad8793_69ae6b33-4cf5-484d-b403-66960e3dc62b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6856350178729975
Encrypted:	false
SSDEEP:	96:84+Fx0iT+bPschMyoI7J9PQXIDcQvc6QcEVcw3cE/n+HbHg6ZAX/d5FMT2SlPkpM:83702aPa0BU/gjEzuiFqZ24IO8n
MD5:	154FEDEA627A3BC80A0C183619098F30
SHA1:	74A4707515F6953F5C1814DE4FD782C436063D17
SHA-256:	57E107420B61C3472B20E9B392EE7A298539C63B22B85E06AE792C886EEA82D3
SHA-512:	056064735EA66B4055391DEDE79804C55856A2536607AE52CC68735132971DBD46EA8C1025246E48494C474CD91F2F05E81608F5BB479F3BA13584D01831A2AD
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.5.7.8.7.0.0.1.5.3.7.7.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.5.7.8.7.0.0.3.7.2.5.1.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.a.e.6.b.3.3.-.4.c.f.5.-.4.8.4.d.-.b.4.0.3.-.6.6.9.6.0.e.3.d.c.6.2.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.e.5.b.b.9.b.-.c.3.7.d.-.4.7.3.5.-.b.d.0.0.-.1.6.d.1.d.2.b.2.a.3.0.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...P.W.S...B.a.n.k.e.r.1...2.6.9.1.6...1.0.1.2.9...1.1.9.4.6...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.0.c.-.0.0.0.1.-.0.0.1.4.-.e.4.c.0.-.3.9.a.c.1.5.2.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.1.6.4.0.6.8.0.9.f.5.f.7.7.b.5.7.4.4.2.5.a.f.9.3.7.e.4.1.0.8.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.a.e.d.2.f.5.e.c.5.4.7.3.9.b.4.e.7.5.1.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER528A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 28 08:45:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	18910
Entropy (8bit):	2.005521753389739
Encrypted:	false
SSDEEP:	96:5E8jRv6s7RPi7n04S7IjzmUBaYSnQkCwk3WIkWIFMI4/4nQ:xtCAOK7IjzmUBaTQppb/4nQ
MD5:	CBC46F1F2D7AF8739276F73DED84E092
SHA1:	C3F4A46F354E18B4CF98D582C458D6EEE26A2BC1
SHA-256:	07E49BB46BEF0B6A23EC9F5A45495FE3DAC4918EBA4D67C077CBCB42799DF84A
SHA-512:	2495A05F3411E26DA05C59A2E68150AEA330EDF2F2E42B6B0325CCC822A1AA14373D36DD94973BB36457BCDEF0FC2F338F83DFF8C2E9F3B625E11D0EB59DB6A0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........O.g............4...............<.......d...............T.......8...........T...............F@......................................................................................................eJ......L.......GenuineIntel............T............O.g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52C9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8490
Entropy (8bit):	3.7021660669553285
Encrypted:	false
SSDEEP:	192:R6l7wVeJOR6G6Y93SUjgmfjyHprT89bUTsf6ycm:R6lXJA6G6Y9SUjgmfuOU4f64
MD5:	9E25DAFA809B6D0BFA20FC1688B54366
SHA1:	83C244B7FC70C347F564A6AC490BD3795F38036F
SHA-256:	4F6D92AB00F44B8A36F60478A95322D51AECD2CBAED7A00049964876EB6BCB82
SHA-512:	7410933019F37F31A65228EEE5BA6C74D9D39CB4EB7821B74D17DF2F8B7994319703D3FB099E4D2C72E3B53DD3A966CAED99CE94E6C77C09D45D431AA79B89B2
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52EA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4834
Entropy (8bit):	4.586370425030019
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg77aI9vkWpW8VYSYm8M4JA7uFO+q8fg68MDZn6aaI+09d:uIjfbI7h97VWJY98R8ZaX+09d
MD5:	8DA4DBC090B0EC8A6F6F00696FE20649
SHA1:	003D6CC7E7ACFC82DE72E908F3162D7A39EB85D1
SHA-256:	ED9D096850C1715434060DB93FBBFA85B78CC0165CA77E6AFC429D38033D79A1
SHA-512:	2069E5220A2DB30826340A58B7D7C905B3A5928A18FE50CC6733BE2B335E9F27ECD5F7B311352883053F26D5767956F1EB0375D083E96893152D930D8828CA45
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="563027" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465704655320058
Encrypted:	false
SSDEEP:	6144:LIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNOdwBCswSb9:MXD94+WlLZMM6YFHY+9
MD5:	9BDF65F794801A2713B19E925E1920A3
SHA1:	0C6AC05BFB3CC66B43FBEB3133E9022030BB8B86
SHA-256:	54169DE5B1035658717C24CC2DF7BD754CF89DC2ADA9C792728AF621FEBE4B78
SHA-512:	1FB85CBF7D40D6A8ED9C0E727F8CBB2E07C2CD87B3EB88619D535CD961619E0B37D896DBCD7447BF6C37B2A5280800DEC0785C4BBEA2FBC57BF50DE9E7AF67F6
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm:Hf..)................................................................................................................................................................................................................................................................................................................................................q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.039924792745053
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe
File size:	758'784 bytes
MD5:	803d402767279864bebd70d810cc7461
SHA1:	faed2f5ec54739b4e751295b28a366ddc5902833
SHA256:	b8ee29a158040d128d74d25483b85d69f1125bf615e7862fec4cb5bd7e86aa47
SHA512:	a7a9177ec4a048a0a286919d10f34d314475057c6f6deb325c52b15acfe33700841780f536f809dfffbe94f161f3138eb38b6d43339cc94350812c7ee4355b11
SSDEEP:	12288:zIKCtCGsX6kBDlaLp6maFHeTrhkE0kkbTtKSPuI+fj52Ku5:zCsxBlop6maFGri9kkxP2p
TLSH:	D7F45D27B2E14877D5732A359C4B8BA4AD32FE0029387A862FF51D0C5F796917836293
File Content Preview:	MZ......................@...............................................!.L.!This file was created by ClamAV for internal use and should not be run...ClamAV - A GPL virus scanner - http://www.clamav.net..$...PE..L...CLAM............................\|......

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x49987c
Entrypoint Section:	.clam01
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, BYTES_REVERSED_LO, 32BIT_MACHINE, DEBUG_STRIPPED, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x4D414C43 [Thu Jan 27 10:43:15 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004995CCh
call 00007F0DA110BFB5h
mov eax, dword ptr [0049B540h]
mov eax, dword ptr [eax]
call 00007F0DA1166F35h
mov eax, dword ptr [0049B540h]
mov eax, dword ptr [eax]
mov edx, 004998DCh
call 00007F0DA1166B30h
mov ecx, dword ptr [0049B38Ch]
mov eax, dword ptr [0049B540h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004981BCh]
call 00007F0DA1166F24h
mov eax, dword ptr [0049B540h]
mov eax, dword ptr [eax]
call 00007F0DA1166F98h
call 00007F0DA11099DBh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.clam01	0x1000	0x99000	0x99000	bf40ea99ac9003c754ab783265e1b952	False	0.5108778211805556	data	6.516141634697236	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.clam02	0x9a000	0x2000	0x2000	441bbe8bb9624cd1cd2ddee4b783c361	False	0.314453125	data	3.090008314069678	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.clam03	0x9c000	0x2000	0x2000	0829f71740aab1ab98b33eae21dee122	False	0.0037841796875	data	0.0	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.clam04	0x9e000	0x3000	0x3000	fd6b00c28f99bff76127bed9fc52647d	False	0.2928873697916667	data	4.342675539495869	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.clam05	0xa1000	0x1000	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.clam06	0xa2000	0x1000	0x1000	611d7cfe7b591996485ca5ced6c4fc5b	False	0.009765625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.0324935130634386	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.clam07	0xa3000	0xb000	0xb000	c324946ce1884cae603d6f4aa055ac8c	False	0.0014870383522727273	data	0.0	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.clam08	0xae000	0xc000	0xc000	2cbca603c5ab673e40b876424fa60fe7	False	0.2618408203125	data	4.064632944980723	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exePID: 6668, Parent PID: 2580

General

Target ID:	0
Start time:	04:44:59
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe"
Imagebase:	0x400000
File size:	758'784 bytes
MD5 hash:	803D402767279864BEBD70D810CC7461
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6844, Parent PID: 6668

General

Target ID:	3
Start time:	04:45:00
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 232
Imagebase:	0x860000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exePID: 6668, Parent PID: 2580COMMON

Non-executed Functions

Function 004752F4 Relevance: 2.2, Strings: 1, Instructions: 909COMMON

Download Yara Rule

Strings

, xrefs: 00475D06

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 33266af4188c364a128479b4328a5d96141f34855588057431a45378421d099e
Instruction ID: 47a5bffa2964e9fc34dba071e52e6b8f5e55c8e08b43aceee1109242752ea362
Opcode Fuzzy Hash: 33266af4188c364a128479b4328a5d96141f34855588057431a45378421d099e
Instruction Fuzzy Hash: 86821834A00A04DFCB04DF69C585ADAB7F1EF48314F6581A6E8089F366C7B8EE41DB95

Function 0047B0D0 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8010488abb8653bd35e22bef729cd03ecb77e867c0202fb95bce014fdef81268
Instruction ID: 62d8b8cbdffb6a8f804240003cb9bf953a20c59589daa48267496a552b9670a3
Opcode Fuzzy Hash: 8010488abb8653bd35e22bef729cd03ecb77e867c0202fb95bce014fdef81268
Instruction Fuzzy Hash: 7922E634A00204DFDB00DF99D589BDAB7F1EF48314F5980E6E9089B362C778AE45DB99

Function 0045554C Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84ae911238db18d2db015a384b13d7710285631c2247b21213cb18d67a50a4f
Instruction ID: f56bd42e2e3fc34692ca7c4c273b773d0c1ea7942f761a939255dd40fa53a8ef
Opcode Fuzzy Hash: b84ae911238db18d2db015a384b13d7710285631c2247b21213cb18d67a50a4f
Instruction Fuzzy Hash: 4BE16034A04A05DFCB10EFA9C8919AEB3F5FF58305B2582A6E80597762C738ED45CB58

Function 0045B050 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3d3e87145f72265c3c382b134be3f76f1002b7c562e5325f67f6f5931ad412
Instruction ID: 6879d7934c1aebf068181592a423d6fb168d2e17cec267e1df085efed48c9673
Opcode Fuzzy Hash: 1c3d3e87145f72265c3c382b134be3f76f1002b7c562e5325f67f6f5931ad412
Instruction Fuzzy Hash: F3B17F34A00504DFCB11DF69C996AAEB7F5EF09705F6540A6F805AB363C738AE05CB98

Function 00484230 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction ID: 515e982fcc113093bc8b9341a6cdcd2dd9e3cb9215dfa8f3b5e9b2f25e208636
Opcode Fuzzy Hash: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction Fuzzy Hash:

Function 00483F1C Relevance: 21.3, Strings: 17, Instructions: 99COMMON

Download Yara Rule

Strings

Process32Next, xrefs: 00483FBE
Heap32ListNext, xrefs: 00483F64
Heap32First, xrefs: 00483F76
Toolhelp32ReadProcessMemory, xrefs: 00483F9A
Module32FirstW, xrefs: 0048403C
Module32NextW, xrefs: 0048404E
kernel32.dll, xrefs: 00483F2B
Module32First, xrefs: 00484018
Module32Next, xrefs: 0048402A
Heap32ListFirst, xrefs: 00483F52
CreateToolhelp32Snapshot, xrefs: 00483F40
Process32NextW, xrefs: 00483FE2
Process32First, xrefs: 00483FAC
Heap32Next, xrefs: 00483F88
Process32FirstW, xrefs: 00483FD0
Thread32Next, xrefs: 00484006
Thread32First, xrefs: 00483FF4

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 0-597814768
Opcode ID: 1517fbb8f2fc55a91694f16bac67bffe5f5eefc0b83aa6421c2e577d5a8b0605
Instruction ID: f1465a8713712c80942f59519ebfb3487f8a4f6b4bc2a566988258e915fcce79
Opcode Fuzzy Hash: 1517fbb8f2fc55a91694f16bac67bffe5f5eefc0b83aa6421c2e577d5a8b0605
Instruction Fuzzy Hash: 7A31E970A502519BDF00FBA59D89B1933E4EB9A70071149BBB501EF294D3BCD850CB1D

Function 0044C75C Relevance: 16.3, Strings: 13, Instructions: 95COMMON

Download Yara Rule

Strings

ImmGetContext, xrefs: 0044C7D9
ImmSetOpenStatus, xrefs: 0044C82D
ImmGetCompositionStringA, xrefs: 0044C86C
ImmNotifyIME, xrefs: 0044C896
WINNLSEnableIME, xrefs: 0044C7A0
ImmSetConversionStatus, xrefs: 0044C818
USER32, xrefs: 0044C794
ImmSetCompositionFontA, xrefs: 0044C857
ImmGetConversionStatus, xrefs: 0044C803
ImmIsIME, xrefs: 0044C881
IMM32.DLL, xrefs: 0044C7BD
ImmReleaseContext, xrefs: 0044C7EE
ImmSetCompositionWindow, xrefs: 0044C842

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: IMM32.DLL$ImmGetCompositionStringA$ImmGetContext$ImmGetConversionStatus$ImmIsIME$ImmNotifyIME$ImmReleaseContext$ImmSetCompositionFontA$ImmSetCompositionWindow$ImmSetConversionStatus$ImmSetOpenStatus$USER32$WINNLSEnableIME
API String ID: 0-3271328588
Opcode ID: 2c2de011df5e6f9bd03e5d6d4ed52b76c26b4d92474bd623b28d5681b4f0a174
Instruction ID: 6fd211dbe72c8468fd0a7f6944041e906204413d62e550cce2e344a72a0a6dbe
Opcode Fuzzy Hash: 2c2de011df5e6f9bd03e5d6d4ed52b76c26b4d92474bd623b28d5681b4f0a174
Instruction Fuzzy Hash: 693130F1642340AEEB40FBA5EDC6E2537E8E759704B15443BB101A72A1DBBC6850CF5E

Function 0040CEA8 Relevance: 7.7, Strings: 6, Instructions: 201COMMON

Download Yara Rule

Strings

m/d/yy, xrefs: 0040CFAD
mmmm d, yyyy, xrefs: 0040CFDA
:mm:ss, xrefs: 0040D12E
:mm, xrefs: 0040D111
AMPM , xrefs: 0040D101
AMPM, xrefs: 0040D0F2

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 0-2493093252
Opcode ID: d5bd6aaaa452622ca11f9407d4f65aef06060f58754a7734ff30ca97abdbb0bd
Instruction ID: 0db0bbb1650eb02f87e554202e17e187a6184e3e35870240f61b426fcac14d52
Opcode Fuzzy Hash: d5bd6aaaa452622ca11f9407d4f65aef06060f58754a7734ff30ca97abdbb0bd
Instruction Fuzzy Hash: 51612E74B001495BDB00FBE5DC81A9E76AADB89304F50947BB201BB3C6CB7CD90A979D

Function 0044CB58 Relevance: 7.6, Strings: 6, Instructions: 103COMMON

Download Yara Rule

Strings

Delphi%.8X, xrefs: 0044CB8A
USER32, xrefs: 0044CC92
C, xrefs: 0044CC35
ControlOfs%.8X%.8X, xrefs: 0044CBDB
\RA, xrefs: 0044CC1F
AnimateWindow, xrefs: 0044CCA2

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32$\RA$C
API String ID: 0-2975105807
Opcode ID: 45a529598262ab94d186ba64b43bccf788646b0d3ec6141afd763b6657d7a2b5
Instruction ID: 0c0811650f451a17ef1d3c8a04d88a937aaf9af9f83876b35c316c9513d1bf20
Opcode Fuzzy Hash: 45a529598262ab94d186ba64b43bccf788646b0d3ec6141afd763b6657d7a2b5
Instruction Fuzzy Hash: ED4173706012459FDB00FFA9ECC2A9E77E5EB59308B50847BF505E73A2DB39A9008B5D

Function 0040AADF Relevance: 6.4, Strings: 5, Instructions: 128COMMON

Download Yara Rule

Strings

AAA, xrefs: 0040ABF4
AM/PM, xrefs: 0040AAEA
AMPM, xrefs: 0040AB64
AAAA, xrefs: 0040ABAD
A/P, xrefs: 0040AB27

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: A/P$AAA$AAAA$AM/PM$AMPM
API String ID: 0-3831542625
Opcode ID: 4173030fa2946b2b4b3058e3074f5ddd5dfa39cbc5b3691e16bce92c2c144eb2
Instruction ID: 485f08505e036614e0ab58d80859560cf360cc079ecd8c7e8a00a4e5fb0f3a66
Opcode Fuzzy Hash: 4173030fa2946b2b4b3058e3074f5ddd5dfa39cbc5b3691e16bce92c2c144eb2
Instruction Fuzzy Hash: 25418E316043049BDB00EB59D901BAE33B69F54315F14807BF908AB2D2DB3DDEA19B8E

Function 004074AC Relevance: 6.3, Strings: 5, Instructions: 61COMMON

Download Yara Rule

Strings

MouseZ, xrefs: 004074BF
MSWHEEL_ROLLMSG, xrefs: 004074CB
Magellan MSWHEEL, xrefs: 004074BA
MSH_WHEELSUPPORT_MSG, xrefs: 004074DA
MSH_SCROLL_LINES_MSG, xrefs: 004074E6

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 0-3736581797
Opcode ID: 33342c5e57defc6496e78b0bcc0bd4f1a85698e21158e47f3ff178486f94dffa
Instruction ID: 00f9bb6ad97b4a395ede4b1f0754adb60aed0ddd6244968d331291a7c9b9c35b
Opcode Fuzzy Hash: 33342c5e57defc6496e78b0bcc0bd4f1a85698e21158e47f3ff178486f94dffa
Instruction Fuzzy Hash: A7112471A48301BFE7109F95DC41BA6B7A8EF44714F20407AB844AB7C1D6787D40CBAA

Function 004122C4 Relevance: 5.1, Strings: 4, Instructions: 137COMMON

Download Yara Rule

Strings

Tw@, xrefs: 004123E7
A, xrefs: 00412384
\w@, xrefs: 0041235B
Lw@, xrefs: 00412440

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Lw@$Tw@$\w@$ A
API String ID: 0-1753979524
Opcode ID: 7640e0e781160700fb7847f18670d564f268005e3e9497a77d0914bc9bce3811
Instruction ID: 75e1deb29df634598ff9c1c4e5149b7aafd65b7da3a13d54adcd2715cadb14b7
Opcode Fuzzy Hash: 7640e0e781160700fb7847f18670d564f268005e3e9497a77d0914bc9bce3811
Instruction Fuzzy Hash: 6E517170A002089FC700DF69DD81AADBBB6EB59304F10407BE944F73A1D7796D54CB99

Function 00425CC0 Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

bmp, xrefs: 00425D76
ico, xrefs: 00425D52
wmf, xrefs: 00425D0A
emf, xrefs: 00425D2E

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: bmp$emf$ico$wmf
API String ID: 0-1896920761
Opcode ID: 49c17c96cf15bb6f705e96c0f1468d93f8e623f24c58095d399d2e7cf670805e
Instruction ID: 1a5e3031b9fbe96f818f933481b1dd555adc955a3797382508bf8f2091530a0b
Opcode Fuzzy Hash: 49c17c96cf15bb6f705e96c0f1468d93f8e623f24c58095d399d2e7cf670805e
Instruction Fuzzy Hash: C421D470700624AFD305EB55ED43E6F736AEB84700F90857AF501AB391DB79AE0187AC

Function 0041AD50 Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

-, xrefs: 0041ADCA
>, xrefs: 0041ADD0
., xrefs: 0041ADC4
Owner, xrefs: 0041ADAD

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$.$>$Owner
API String ID: 0-4224991809
Opcode ID: 07301154a45e4223f6cce4a4349071a765dda104e5e5aedc8d4378e3a8f2ea22
Instruction ID: 5dc4a0a9b1d8df07a3d987b2d3067df08ae6d9964ccb66c32671c08e444ae4fb
Opcode Fuzzy Hash: 07301154a45e4223f6cce4a4349071a765dda104e5e5aedc8d4378e3a8f2ea22
Instruction Fuzzy Hash: 71113675A01A501FDB228A34A8803EB7BD79B82724F5402BBD45197B82D63C8D92828B

Function 0041E0B4 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

nil, xrefs: 0041E10C
Null, xrefs: 0041E0F1
True, xrefs: 0041E0D6
False, xrefs: 0041E0BA

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: False$Null$True$nil
API String ID: 0-1063864068
Opcode ID: 8708449b1dfa5d9d46a3e4ee7451a94e7077a11bb258003c9320e23e0925d4dd
Instruction ID: d14d3266899a2f62ae1fc9b1c9edb727b75d33fa74ef38d42d9e780a80340e2f
Opcode Fuzzy Hash: 8708449b1dfa5d9d46a3e4ee7451a94e7077a11bb258003c9320e23e0925d4dd
Instruction Fuzzy Hash: 2EF0EC38340661538A10BA6F1D811DA02435A8675C724947BFC41DFB4BCB7ECC8F435E

Function 0041BF30 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

False, xrefs: 0041BFB2
True, xrefs: 0041BFC0
nil, xrefs: 0041BFCE
Null, xrefs: 0041BFDC

Memory Dump Source

Source File: 00000000.00000002.1865390851.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1865377545.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865390851.00000000004AE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: False$Null$True$nil
API String ID: 0-1063864068
Opcode ID: 9fb1612a1ace9855cfed49be8038c2657ed9d8e803cb42f3d5c67caf3062d3d8
Instruction ID: b37862689de4ce16f09c91cb8804fb434fdfb7bcc72a2d1339e768e31df6b60e
Opcode Fuzzy Hash: 9fb1612a1ace9855cfed49be8038c2657ed9d8e803cb42f3d5c67caf3062d3d8
Instruction Fuzzy Hash: 20014B7932916087C204767E2C629EE1685CB88358721853FB285D7786CB2CC88356DF

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_4870883f729ecc58dcb48bcd2b1e52fb1f29697_5aad8793_69ae6b33-4cf5-484d-b403-66960e3dc62b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER528A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52C9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52EA.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exePID: 6668, Parent PID: 2580

General

Chronological Activities

Analysis Process: WerFault.exePID: 6844, Parent PID: 6668

General

Chronological Activities

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Banker1.26916.10129.11946.exe