Windows Analysis Report
RafaelConnect.exe

Overview

General Information

Sample name: RafaelConnect.exe
Analysis ID: 1546124
MD5: 7f4cc7b5c70bf16dabbed8fa5a6fa843
SHA1: 4c6df55517407dd0b8b1826368855e737ac36809
SHA256: dd62b33333cd1aab1345cdab28d7bcba0f8be11f79a76eb0c3674d3d0677282c
Tags: exevacationtogotravels-netuser-JAMESWT_MHT
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

.NET source code contains very large array initializations
Drops executables to the windows directory (C:\Windows) and starts them
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Found dropped PE file which has not been started or loaded
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Use Short Name Path in Command Line
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)

Classification

Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50000 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50005 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50007 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50009 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: RafaelConnect.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\ASUS\Desktop\persiste explorer.exe\Raf_ui\Raf_ui\obj\x64\Release\RafaelConnect.pdb source: RafaelConnect.exe
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:49769
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:49990
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vacationtogotravels.netConnection: Keep-Alive
Source: msapplication.xml1.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x7706a4b0,0x01db2b98</date><accdate>0x7706a4b0,0x01db2b98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x77102e95,0x01db2b98</date><accdate>0x77102e95,0x01db2b98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x771290ae,0x01db2b98</date><accdate>0x7714f2e6,0x01db2b98</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: vacationtogotravels.net
Source: unknown HTTP traffic detected: POST /register HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: vacationtogotravels.netContent-Length: 8Connection: Keep-AliveCache-Control: no-cache
Source: RafaelConnect.exe String found in binary or memory: http://rafaelconnect.com/form?token=QWEASDMCVNNASOASDASDBQUVBCCASDBASBDYQWUQVVVVCBNHFTRYUWJJNINQN123
Source: msapplication.xml.6.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.6.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.6.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.6.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.6.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.6.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.6.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.6.dr String found in binary or memory: http://www.youtube.com/
Source: RafaelConnect.exe, 00000000.00000002.3393916119.00000000144D1000.00000004.00000800.00020000.00000000.sdmp, MsDef.exe, 00000002.00000000.2146685120.00007FF722592000.00000002.00000001.01000000.00000006.sdmp, MsDef.exe.0.dr String found in binary or memory: https://vacationtogotravels.net
Source: imagestore.dat.8.dr String found in binary or memory: https://vacationtogotravels.net/favicon.ico~
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registels.net/register
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/register
Source: ~DF863B075946964495.TMP.6.dr String found in binary or memory: https://vacationtogotravels.net/register(
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttp
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttpels.net/register
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttps://vacationtogotravels.net/regi
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttps://vacationtogotravels.net/regiTL17
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttps://vacationtogotravels.net/regiels.net/register
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttps://vacationtogotravels.net/regier
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttps://vacationtogotravels.net/register
Source: {AE989862-978B-11EF-8C2D-ECF4BB2D2496}.dat.6.dr String found in binary or memory: https://vacationtogotravels.net/registerPhttpster
Source: MsDef.exe, 00000002.00000003.2236255150.000002A4251AF000.00000004.00000020.00020000.00000000.sdmp, MsDef.exe, 00000002.00000003.2231412809.000002A4251AD000.00000004.00000020.00020000.00000000.sdmp, MsDef.exe, 00000002.00000003.2238786161.000002A4251AB000.00000004.00000020.00020000.00000000.sdmp, MsDef.exe, 00000002.00000003.2235466771.000002A4251AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vacationtogotravels.net/upload
Source: MsDef.exe, 00000002.00000003.2244780322.000002A425199000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vacationtogotravels.net/uploadr
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50000 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50005 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50007 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50009 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.6:50013 version: TLS 1.2

System Summary
barindex
.NET source code contains very large array initializations
Source: RafaelConnect.exe, Program.cs Large array initialization: Main: array initializer size 576000
Source: RafaelConnect.exe, Program.cs Large array initialization: Main: array initializer size 10240
Creates files inside the system directory
Source: C:\Users\user\Desktop\RafaelConnect.exe File created: C:\Windows\twain_32\MsDef.exe Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe File created: C:\Windows\cscapi.dll Jump to behavior
PE file does not import any functions
Source: RafaelConnect.exe Static PE information: No import functions for PE file found
Source: classification engine Classification label: mal48.evad.winEXE@9/27@1/1
Source: C:\Program Files\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3940:120:WilError_03
Source: C:\Program Files\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF74CDFB90435CCD30.TMP Jump to behavior
Source: RafaelConnect.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RafaelConnect.exe Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
Source: C:\Users\user\Desktop\RafaelConnect.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\RafaelConnect.exe "C:\Users\user\Desktop\RafaelConnect.exe"
Source: C:\Users\user\Desktop\RafaelConnect.exe Process created: C:\Windows\twain_32\MsDef.exe "C:\Windows\twain_32\MsDef.exe"
Source: C:\Windows\twain_32\MsDef.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3152 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Users\user\Desktop\RafaelConnect.exe Process created: C:\Windows\twain_32\MsDef.exe "C:\Windows\twain_32\MsDef.exe" Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3152 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\twain_32\MsDef.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\twain_32\MsDef.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\twain_32\MsDef.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\twain_32\MsDef.exe Section loaded: ieproxy.dll Jump to behavior
Source: C:\Windows\twain_32\MsDef.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\twain_32\MsDef.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\RafaelConnect.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: RafaelConnect.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: RafaelConnect.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: RafaelConnect.exe Static file information: File size 1257472 > 1048576
Source: RafaelConnect.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: RafaelConnect.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\ASUS\Desktop\persiste explorer.exe\Raf_ui\Raf_ui\obj\x64\Release\RafaelConnect.pdb source: RafaelConnect.exe
Binary contains a suspicious time stamp
Source: RafaelConnect.exe Static PE information: 0x801FD091 [Fri Feb 12 06:24:17 2038 UTC]
PE file contains sections with non-standard names
Source: MsDef.exe.0.dr Static PE information: section name: .msvcjmc
Source: MsDef.exe.0.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\RafaelConnect.exe Code function: 0_2_00007FFD346800BD pushad ; iretd 0_2_00007FFD346800C1
Source: C:\Users\user\Desktop\RafaelConnect.exe Code function: 0_2_00007FFD3468309D pushad ; retf 0_2_00007FFD346830AD
Source: C:\Users\user\Desktop\RafaelConnect.exe Code function: 0_2_00007FFD34680FE5 pushad ; iretd 0_2_00007FFD34680FFD

Persistence and Installation Behavior
barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Users\user\Desktop\RafaelConnect.exe Executable created and started: C:\Windows\twain_32\MsDef.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\RafaelConnect.exe File created: C:\Windows\twain_32\MsDef.exe Jump to dropped file
Source: C:\Users\user\Desktop\RafaelConnect.exe File created: C:\Windows\cscapi.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\RafaelConnect.exe File created: C:\Windows\twain_32\MsDef.exe Jump to dropped file
Source: C:\Users\user\Desktop\RafaelConnect.exe File created: C:\Windows\cscapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\RafaelConnect.exe Memory allocated: 1890000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Memory allocated: 1C4C0000 memory reserve | memory write watch Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\RafaelConnect.exe Dropped PE file which has not been started: C:\Windows\cscapi.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\twain_32\MsDef.exe TID: 2188 Thread sleep time: -85000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\RafaelConnect.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\RafaelConnect.exe Process created: C:\Windows\twain_32\MsDef.exe "C:\Windows\twain_32\MsDef.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\RafaelConnect.exe Queries volume information: C:\Users\user\Desktop\RafaelConnect.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RafaelConnect.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546124 Sample: RafaelConnect.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 48 29 windowsupdatebg.s.llnwi.net 2->29 31 vacationtogotravels.net 2->31 33 .NET source code contains very large array initializations 2->33 8 RafaelConnect.exe 5 2->8         started        12 iexplore.exe 69 104 2->12         started        signatures3 process4 file5 23 C:\Windows\twain_32\MsDef.exe, PE32+ 8->23 dropped 25 C:\Windows\cscapi.dll, PE32+ 8->25 dropped 35 Drops executables to the windows directory (C:\Windows) and starts them 8->35 14 MsDef.exe 1 8->14         started        16 iexplore.exe 44 12->16         started        signatures6 process7 dnsIp8 19 conhost.exe 14->19         started        27 vacationtogotravels.net 89.221.225.227, 443, 49713, 49714 SUMTEL-AS-RIPEMoscowRussiaRU Russian Federation 16->27 21 ssvagent.exe 501 16->21         started        process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
89.221.225.227
 vacationtogotravels.net Russian Federation
41691 SUMTEL-AS-RIPEMoscowRussiaRU false

Contacted Domains

Name IP Active
vacationtogotravels.net 89.221.225.227 true
windowsupdatebg.s.llnwi.net 87.248.204.0 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://vacationtogotravels.net/register false
    		unknown
    https://vacationtogotravels.net/upload false
      		unknown
      https://vacationtogotravels.net/favicon.ico false
        		unknown