Edit tour

Windows Analysis Report
imagelogger.exe

Overview

General Information

Sample name:	imagelogger.exe
Analysis ID:	1575694
MD5:	9655b8120c0d0469ee87eebdeeca3b4d
SHA1:	88694919a39988857213bde785b5c591e1525a35
SHA256:	d5355284b6411903ab344c3da20178ff2891b7c14b2cecf27943c9331e6fe652
Tags:	AsyncRATexeXWormuser-lontze7
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

imagelogger.exe (PID: 3820 cmdline: "C:\Users\user\Desktop\imagelogger.exe" MD5: 9655B8120C0D0469EE87EEBDEECA3B4D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["among-publication.at.ply.gg"], "Port": 42209, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.0"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
imagelogger.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
imagelogger.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
imagelogger.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb7ec:$s6: VirtualBox 0xb74a:$s8: Win32_ComputerSystem 0xc68c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc729:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc83e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc2ae:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\imagelogger	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\imagelogger	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\imagelogger	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb7ec:$s6: VirtualBox 0xb74a:$s8: Win32_ComputerSystem 0xc68c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc729:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc83e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc2ae:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb5ec:$s6: VirtualBox 0xb54a:$s8: Win32_ComputerSystem 0xc48c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc529:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc63e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc0ae:$cnc4: POST / HTTP/1.1
00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1c264:$s6: VirtualBox 0x1c1c2:$s8: Win32_ComputerSystem 0x1d104:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1d1a1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1d2b6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1cd26:$cnc4: POST / HTTP/1.1
00000000.00000002.3786146895.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: imagelogger.exe PID: 3820	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.imagelogger.exe.12aa1a78.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.imagelogger.exe.12aa1a78.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.imagelogger.exe.12aa1a78.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb7ec:$s6: VirtualBox 0xb74a:$s8: Win32_ComputerSystem 0xc68c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc729:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc83e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc2ae:$cnc4: POST / HTTP/1.1
0.0.imagelogger.exe.780000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.imagelogger.exe.780000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.imagelogger.exe.780000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb7ec:$s6: VirtualBox 0xb74a:$s8: Win32_ComputerSystem 0xc68c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc729:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc83e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc2ae:$cnc4: POST / HTTP/1.1
0.2.imagelogger.exe.12aa1a78.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.imagelogger.exe.12aa1a78.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x99ec:$s6: VirtualBox 0x994a:$s8: Win32_ComputerSystem 0xa88c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xa929:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xaa3e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xa4ae:$cnc4: POST / HTTP/1.1
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\imagelogger.exe, ProcessId: 3820, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk

Suricata Signatures

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T08:39:03.103686+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.9	49897	147.185.221.229	42209	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: imagelogger.exe

Avira: detected

Antivirus detection for URL or domain

Source: among-publication.at.ply.gg

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\imagelogger

Avira: detection malicious, Label: HEUR/AGEN.1311620

Found malware configuration

Source: imagelogger.exe

Malware Configuration Extractor: Xworm {"C2 url": ["among-publication.at.ply.gg"], "Port": 42209, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.0"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\imagelogger

ReversingLabs: Detection: 76%

Multi AV Scanner detection for submitted file

Source: imagelogger.exe	Virustotal: Detection: 75%			Perma Link
Source: imagelogger.exe	ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\imagelogger

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: imagelogger.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: imagelogger.exe	String decryptor: among-publication.at.ply.gg
Source: imagelogger.exe	String decryptor: 42209
Source: imagelogger.exe	String decryptor: <123456789>
Source: imagelogger.exe	String decryptor: <Xwormmm>
Source: imagelogger.exe	String decryptor: XWorm V5.0
Source: imagelogger.exe	String decryptor: USB.exe
Source: imagelogger.exe	String decryptor: %Temp%
Source: imagelogger.exe	String decryptor: imagelogger

Source: imagelogger.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: imagelogger.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.9:49723 -> 147.185.221.229:42209
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.9:49897 -> 147.185.221.229:42209

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: among-publication.at.ply.gg

Yara detected Generic Downloader

Source: Yara match	File source: imagelogger.exe, type: SAMPLE
Source: Yara match	File source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.imagelogger.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\imagelogger, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.9:49723 -> 147.185.221.229:42209

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: among-publication.at.ply.gg

Source: imagelogger.exe, imagelogger.0.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: imagelogger.exe, 00000000.00000002.3786146895.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\imagelogger.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\imagelogger.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: imagelogger.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.imagelogger.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.imagelogger.exe.12aa1a78.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\imagelogger, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: imagelogger.exe

Source: C:\Users\user\Desktop\imagelogger.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\imagelogger.exe	Code function: 0_2_00007FF887B01C11	0_2_00007FF887B01C11
Source: C:\Users\user\Desktop\imagelogger.exe	Code function: 0_2_00007FF887B06B02	0_2_00007FF887B06B02
Source: C:\Users\user\Desktop\imagelogger.exe	Code function: 0_2_00007FF887B010FA	0_2_00007FF887B010FA
Source: C:\Users\user\Desktop\imagelogger.exe	Code function: 0_2_00007FF887B05D56	0_2_00007FF887B05D56

Source: imagelogger.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: imagelogger.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.imagelogger.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.imagelogger.exe.12aa1a78.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\imagelogger, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: imagelogger.exe, iLHp10vxetrAVm5r7Ty3zS0f4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: imagelogger.exe, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: imagelogger.exe, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: imagelogger.0.dr, iLHp10vxetrAVm5r7Ty3zS0f4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: imagelogger.0.dr, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: imagelogger.0.dr, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, iLHp10vxetrAVm5r7Ty3zS0f4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: imagelogger.exe, QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.cs	Base64 encoded string: 'rwnY/gw2Ybo8uWs0nr8b4bEyH7sHv54XzyDHXDWprHMnXW0osxu0dJS8o4KaktI4'
Source: imagelogger.0.dr, QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.cs	Base64 encoded string: 'rwnY/gw2Ybo8uWs0nr8b4bEyH7sHv54XzyDHXDWprHMnXW0osxu0dJS8o4KaktI4'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.cs	Base64 encoded string: 'rwnY/gw2Ybo8uWs0nr8b4bEyH7sHv54XzyDHXDWprHMnXW0osxu0dJS8o4KaktI4'

Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: imagelogger.0.dr, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: imagelogger.0.dr, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: imagelogger.exe, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: imagelogger.exe, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/2@2/2

Source: C:\Users\user\Desktop\imagelogger.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\imagelogger.exe	Mutant created: \Sessions\1\BaseNamedObjects\XoA0MqwQ1nAIklDm

Source: C:\Users\user\Desktop\imagelogger.exe

File created: C:\Users\user\AppData\Local\Temp\imagelogger

Jump to behavior

Source: imagelogger.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: imagelogger.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\imagelogger.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: imagelogger.exe	Virustotal: Detection: 75%
Source: imagelogger.exe	ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\imagelogger.exe

File read: C:\Users\user\Desktop\imagelogger.exe

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: imagelogger.lnk.0.dr

LNK file: ..\..\..\..\..\..\Local\Temp\imagelogger

Source: imagelogger.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: imagelogger.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: imagelogger.exe, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.A6Pa6WJLrbjhcbA4gRhylLdc7cK4M8AGrvpXi0Z0Tabt9TzorwueTMUTsLT3wteU9,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.y167JS3m9QengzGgezAcVIITVP5ZsenwOrXtMuOkhGGlDzWK1zaC33ZrtJyOZdj4j,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.os0mI79tY4AuRf1LtMhmQJj0Zy6Qz10bGpiBEUiwnH7Mt3wHb7iDReouccdcO1u7k,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.b5u6ogM8W7noyvGdVlTSROF3wLJHzwDvR8nijCr5hkBblVBFiEbkHM7kmreMu9sCf,xFEI6GFflrDoYGq8T7NvZ6oxo.kzCseTU8DgMUs7rpfRccD230G()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: imagelogger.exe, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[2],xFEI6GFflrDoYGq8T7NvZ6oxo.OtQcn5ymMtuGiMgBBEPeKkxfm(Convert.FromBase64String(_1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: imagelogger.exe, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: imagelogger.0.dr, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.A6Pa6WJLrbjhcbA4gRhylLdc7cK4M8AGrvpXi0Z0Tabt9TzorwueTMUTsLT3wteU9,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.y167JS3m9QengzGgezAcVIITVP5ZsenwOrXtMuOkhGGlDzWK1zaC33ZrtJyOZdj4j,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.os0mI79tY4AuRf1LtMhmQJj0Zy6Qz10bGpiBEUiwnH7Mt3wHb7iDReouccdcO1u7k,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.b5u6ogM8W7noyvGdVlTSROF3wLJHzwDvR8nijCr5hkBblVBFiEbkHM7kmreMu9sCf,xFEI6GFflrDoYGq8T7NvZ6oxo.kzCseTU8DgMUs7rpfRccD230G()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: imagelogger.0.dr, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[2],xFEI6GFflrDoYGq8T7NvZ6oxo.OtQcn5ymMtuGiMgBBEPeKkxfm(Convert.FromBase64String(_1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: imagelogger.0.dr, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.A6Pa6WJLrbjhcbA4gRhylLdc7cK4M8AGrvpXi0Z0Tabt9TzorwueTMUTsLT3wteU9,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.y167JS3m9QengzGgezAcVIITVP5ZsenwOrXtMuOkhGGlDzWK1zaC33ZrtJyOZdj4j,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.os0mI79tY4AuRf1LtMhmQJj0Zy6Qz10bGpiBEUiwnH7Mt3wHb7iDReouccdcO1u7k,QfQVihqdbg4jqoGI8F2rHDd9Ww7d0qYDqqqA4sGlPlTwl1M4nI2RNz5ZI3dhWtwrE.b5u6ogM8W7noyvGdVlTSROF3wLJHzwDvR8nijCr5hkBblVBFiEbkHM7kmreMu9sCf,xFEI6GFflrDoYGq8T7NvZ6oxo.kzCseTU8DgMUs7rpfRccD230G()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[2],xFEI6GFflrDoYGq8T7NvZ6oxo.OtQcn5ymMtuGiMgBBEPeKkxfm(Convert.FromBase64String(_1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { _1DE10xLs4SH4ueKjtdXFzsw8zBUGwJ9KdBBybrmmJHy4YYUTR6A7uZHPVHPyJbxqM8gya6dYswei0XRMYLq[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: imagelogger.exe, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: Rh0goXkSWFbkOaXSLoOXl7VE3hBxuE527s0Vo2vHfzx5J29XhA System.AppDomain.Load(byte[])
Source: imagelogger.exe, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: eu8dOAACozhHu7F0nR6lsS9serqkhXWieYrzL2py0xCOc2wotCXhWIm5t0OAgeLT5fEHYljmuKlOu0ZfY2T System.AppDomain.Load(byte[])
Source: imagelogger.exe, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: eu8dOAACozhHu7F0nR6lsS9serqkhXWieYrzL2py0xCOc2wotCXhWIm5t0OAgeLT5fEHYljmuKlOu0ZfY2T
Source: imagelogger.0.dr, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: Rh0goXkSWFbkOaXSLoOXl7VE3hBxuE527s0Vo2vHfzx5J29XhA System.AppDomain.Load(byte[])
Source: imagelogger.0.dr, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: eu8dOAACozhHu7F0nR6lsS9serqkhXWieYrzL2py0xCOc2wotCXhWIm5t0OAgeLT5fEHYljmuKlOu0ZfY2T System.AppDomain.Load(byte[])
Source: imagelogger.0.dr, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: eu8dOAACozhHu7F0nR6lsS9serqkhXWieYrzL2py0xCOc2wotCXhWIm5t0OAgeLT5fEHYljmuKlOu0ZfY2T
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: Rh0goXkSWFbkOaXSLoOXl7VE3hBxuE527s0Vo2vHfzx5J29XhA System.AppDomain.Load(byte[])
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: eu8dOAACozhHu7F0nR6lsS9serqkhXWieYrzL2py0xCOc2wotCXhWIm5t0OAgeLT5fEHYljmuKlOu0ZfY2T System.AppDomain.Load(byte[])
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	.Net Code: eu8dOAACozhHu7F0nR6lsS9serqkhXWieYrzL2py0xCOc2wotCXhWIm5t0OAgeLT5fEHYljmuKlOu0ZfY2T

Source: C:\Users\user\Desktop\imagelogger.exe

Code function: 0_2_00007FF887B02458 push ebx; iretd

0_2_00007FF887B024CA

Source: imagelogger.exe, iKJ4AENNa8mLOwx6LzIjB1mfK.cs	High entropy of concatenated method names: 'nC0yQUxeBXWwbCn2oEsKG8h2c', 'WM8OMu8NW0st6cj12D1kCuuSN', 't0r1qJNm57sGGY0Lo3CiY1c61', '_01rIKLg4oD', 'MV5FRB5ztA', 'c1TtQhPnv5Yxq7HmN9AYJhxdPXQQj8q8QvCRRHHYl32', 'mNqw4QzXRPzNN2X4AVMMZ6koduHt21Bb7W3E7pgCo6i', 'U9vIMA5aR1jivNIpEfRpYRKK0smFebdlZHNAQRxWXkY', 'U4c3HJaF6uWTSOzvNTtone5R8uxjwpBZbAwvu8GiqMo', 'sGtMU9I0UPZWFYbjnx3UBLUXdOj9H6lmbGKwSU7F3el'
Source: imagelogger.exe, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	High entropy of concatenated method names: '_9rPtYGRERqFQvVrbzQmj2bGLFE9HC4TvV39rcJkRRiNGX2QzCj', 'Rh0goXkSWFbkOaXSLoOXl7VE3hBxuE527s0Vo2vHfzx5J29XhA', '_5V5HQHjlqlXaQadQAeJt8bK8U0niy8Ef7AOvPhvmwDah4LUWg2', 'qLGSXU8VFblvvVhBOryozoQaY3U5tA0kXgdwR5mlmJaPvb4kik', 'lwVjD1vbHzdvylMr6uiuUAEvaN7DlxkJF9iXLAoleC9kHYLEXv', 'XAKpGZcAGjjnpWeCmD3ZtWZuwqznUe9LILhnADGiIuipy7Ccf2', 'EsH3qgp7pkAt7uaa1c81LvVV5LVlunZdyxBYJuu0f9uOSRIXbj', 'ZgL62uslYzditFt64DuHZnrJAy4cb5oFq8pORuMeeQiaDDhf0O53fXXPu1E9VvRHcgbmVsiTEuYDQq9z1Pu', 's2rWrpr1Sukp40kBxMV66NPfnaaOsCDJHlS4vSWwPUq4M6AIAQxe2AjmSjLqBEGi26FywfybF1SsaABe22h', 'rqF6szm3zNjsTa24gavKwQe4sgVMXosbfcGSOeSKvKF8mz0lKYLVgq2aeZHe5wOan3MaYLNNiNUtBnPOWBs'
Source: imagelogger.exe, FyZqVu9h9CsbV1aafmGwZ44IEsxosU9Beg1nA2HahTn3k0bQySpC5E60vqnHHztAe1FVjwYJEfE67Bh42OD.cs	High entropy of concatenated method names: 'AddClipboardFormatListener', 'SetParent', 'JAsLW9da6RO33ELvCfP0JggQHRI60tuQj5YEXhkLFfg7h0MKHxBC82B8kJNXXUeszYzSQSocu1k2YMHfOHW', 'XYjsGaruuR', 'Jo9e9fOAnS', '_9cfY7EEETc', '_12cS8MFqK0'
Source: imagelogger.exe, 6coZ22sBrCOss4k7p3VZM9puHdz8RszCObd8aBYgrrjj8EE2ynlgAbUzL7Yy61NekVlmf16HICMU9m5WWnW.cs	High entropy of concatenated method names: 'uTcvL4HbodJUCfqMhQ6HmndkAPRoLR1pilq7SZDxrLKjGUKwFxs9RMYSlipiswRf8B8bKHBNQvu0y29R6jS', 'SxnOjnEX53', 'ZVnpRUyERH', 'bJttju9KnW', 'tsmHl4044f'
Source: imagelogger.exe, qh407p2eG1CMRhpADi7tfM32osPWCEqBZPr01IEWBGGCUBSw61I5ngw21nKtDcGkIBLoAtEC3URLcgT9ORn.cs	High entropy of concatenated method names: 'GNP9uwbibPaD3ssHD6APyDLs7uLXZOLx4i7QKNbCyiC37ODnskXGXVUiCBvF9h1cGqGF7NqP5RNPlywCK1Y', 'Fy6RrcX8g8n01Fq0y1GbP1Q3NQ9pudmWqfqWxtLjZyEBPTkJ9g5ltFHoG569XXzbVzmq1aIxizILbxfCiJZ', '_8wBe8z0kOo', 'mfzfGGPne1', 'GmI2M03612', '_8MaCUfAOgC'
Source: imagelogger.exe, 5d5M6UPj5GkFOQYeqNDALKVMzAe60umRAMqpJQyhB6Wr8WEnIMYJIqtX2lIBwb4Ew.cs	High entropy of concatenated method names: 't0BrpmAMBQObySLJZ5SHZSY9GHgV48pVpShl1kuxGmhTgOqLHEmnE07FeaIUSnM02', 'm0j6o5tD9QQXQvFyWlEy4HzG4ACa9ITotrohyc6K1Zk8D6gsLRg514RRexzcZl1fY', 'tT8jdxeN16arHRLQyJKpGUFJOszyxPfAoISq8A7mitfRouvlnmkmkz27kHqM85Emy', 'mFbODUCE8dpKW9AR5nVBndnjb3yLLHXZX0zEBgmqhMsxNKqyiV', 'rSXFd9o5nGCtSWajz4F0jn84lN1zDs4QKCtsiYZoUuGHntHMZA', 'K0N84TNour9CLwqVGnVmYgkSA8lKXA3hsF1ZBjTR7Knjm6PkII', 'lCpz2FFAEWWQSyZwa0eNlTt6sfL2benCAWRvPA3dv3lKhwbvY3', 'BzcL6rbPioJuBF5eklmx526SFWYn0AMD4oJ7mYZWOpYITit5WR', 'QywiyVPJ8m9lvIXw6Mti0AuUJDA2mSU0tuAw3oAejjSlQM7pbQ', 'MtxbmVO8XOmJr3inJsWvpd9mYJCPUq9hUB6U7H8ljZQYUW8JUZ'
Source: imagelogger.exe, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	High entropy of concatenated method names: 'ZRIsfo0V1spJfGDtUf8dSoMQgVYLuz1rnLJKAnK1U0GhZbBq42', '_3aMDbZ2q9e20BmZEhIaJt6XlXm5UJhLKFpFQN49bCAjEUKABU4', 'BxN2FLjOWZDzBH5bLtgYmJqRF6C5T5cGazEdfHcn8ZI22nuWdB', 'KfOsm4kFLGAEdhc33hOLO132StxtaXF8wEQJdC800FLNbytrS8', 'sgif8D08CSsyeOD7aYFmeF60RZsfuOE9qVqHpmJgGZTIJZbgCA', 'vttQD75kDGiceC5WBSry2w1mQ4vqHsXs6B9e0rnKFmtFSmkmHW', 'nCHVTlnALkhlGRnPg8KuFukEWjnWBiTZJdROj6j2zlk3AS5Bt7', 'PPWozYnItdDIat0WNDwRWFXQRmilw2RHem6oQ4Eap1KEMtSUSc', 'ZzHGkqlfneKc9axyxzoJiqJdiuGfz9TcwEKKqDYCoa8oVP6oML', 'NnlRXBx3RxlQimLoiBIInKmhL71dh1B8tCet1JjjwKYQnstxOD'
Source: imagelogger.exe, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	High entropy of concatenated method names: 'mHTAb9BI4irvmiRltQrnwimEm', 'Jm6HacNyF4NnJaP2xFwNPFp3p', 'E7W4z6SnvbN6BykbMeXkHzJ9Z', 'M5xD61rMj4IIuhi0JLJU6T2JX', 'i8pbxD6vQuQpTDl5F1DsF2eoX', 'Xzwtbf7NUv2JuF7qSQ1vvuzmO', 'LkDQ0SqvnbgYpr06sZPUDUHgG', '_1bPapUWnAMMbbbBMQebBRCb8X', 'aJAIdEMQXqmtwMWpIxXaFTe9P', 'kUisE9idkGaPkAYlExoFAx5qW'
Source: imagelogger.exe, FhrwYiRTRf2VDyM59kmulbyU2.cs	High entropy of concatenated method names: 'nQtJxtWE0d3JO6W4O2FiT0jJe', 'qpPIeuuyevTg3ZI0Ea1Ctui1o', 'Moq2nmPwCP9cbjFNPGH2hHiL1', 'mV5DPAK60gzly7fLERlkR2FgB', 'eHS0HYtDbc', '_0qXwHtIvIk', 'LZtYzkaDWK', 'V4q16VWCi2', 'UxJpbFKhjE', 'vJy7dElNqI'
Source: imagelogger.0.dr, iKJ4AENNa8mLOwx6LzIjB1mfK.cs	High entropy of concatenated method names: 'nC0yQUxeBXWwbCn2oEsKG8h2c', 'WM8OMu8NW0st6cj12D1kCuuSN', 't0r1qJNm57sGGY0Lo3CiY1c61', '_01rIKLg4oD', 'MV5FRB5ztA', 'c1TtQhPnv5Yxq7HmN9AYJhxdPXQQj8q8QvCRRHHYl32', 'mNqw4QzXRPzNN2X4AVMMZ6koduHt21Bb7W3E7pgCo6i', 'U9vIMA5aR1jivNIpEfRpYRKK0smFebdlZHNAQRxWXkY', 'U4c3HJaF6uWTSOzvNTtone5R8uxjwpBZbAwvu8GiqMo', 'sGtMU9I0UPZWFYbjnx3UBLUXdOj9H6lmbGKwSU7F3el'
Source: imagelogger.0.dr, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	High entropy of concatenated method names: '_9rPtYGRERqFQvVrbzQmj2bGLFE9HC4TvV39rcJkRRiNGX2QzCj', 'Rh0goXkSWFbkOaXSLoOXl7VE3hBxuE527s0Vo2vHfzx5J29XhA', '_5V5HQHjlqlXaQadQAeJt8bK8U0niy8Ef7AOvPhvmwDah4LUWg2', 'qLGSXU8VFblvvVhBOryozoQaY3U5tA0kXgdwR5mlmJaPvb4kik', 'lwVjD1vbHzdvylMr6uiuUAEvaN7DlxkJF9iXLAoleC9kHYLEXv', 'XAKpGZcAGjjnpWeCmD3ZtWZuwqznUe9LILhnADGiIuipy7Ccf2', 'EsH3qgp7pkAt7uaa1c81LvVV5LVlunZdyxBYJuu0f9uOSRIXbj', 'ZgL62uslYzditFt64DuHZnrJAy4cb5oFq8pORuMeeQiaDDhf0O53fXXPu1E9VvRHcgbmVsiTEuYDQq9z1Pu', 's2rWrpr1Sukp40kBxMV66NPfnaaOsCDJHlS4vSWwPUq4M6AIAQxe2AjmSjLqBEGi26FywfybF1SsaABe22h', 'rqF6szm3zNjsTa24gavKwQe4sgVMXosbfcGSOeSKvKF8mz0lKYLVgq2aeZHe5wOan3MaYLNNiNUtBnPOWBs'
Source: imagelogger.0.dr, FyZqVu9h9CsbV1aafmGwZ44IEsxosU9Beg1nA2HahTn3k0bQySpC5E60vqnHHztAe1FVjwYJEfE67Bh42OD.cs	High entropy of concatenated method names: 'AddClipboardFormatListener', 'SetParent', 'JAsLW9da6RO33ELvCfP0JggQHRI60tuQj5YEXhkLFfg7h0MKHxBC82B8kJNXXUeszYzSQSocu1k2YMHfOHW', 'XYjsGaruuR', 'Jo9e9fOAnS', '_9cfY7EEETc', '_12cS8MFqK0'
Source: imagelogger.0.dr, 6coZ22sBrCOss4k7p3VZM9puHdz8RszCObd8aBYgrrjj8EE2ynlgAbUzL7Yy61NekVlmf16HICMU9m5WWnW.cs	High entropy of concatenated method names: 'uTcvL4HbodJUCfqMhQ6HmndkAPRoLR1pilq7SZDxrLKjGUKwFxs9RMYSlipiswRf8B8bKHBNQvu0y29R6jS', 'SxnOjnEX53', 'ZVnpRUyERH', 'bJttju9KnW', 'tsmHl4044f'
Source: imagelogger.0.dr, qh407p2eG1CMRhpADi7tfM32osPWCEqBZPr01IEWBGGCUBSw61I5ngw21nKtDcGkIBLoAtEC3URLcgT9ORn.cs	High entropy of concatenated method names: 'GNP9uwbibPaD3ssHD6APyDLs7uLXZOLx4i7QKNbCyiC37ODnskXGXVUiCBvF9h1cGqGF7NqP5RNPlywCK1Y', 'Fy6RrcX8g8n01Fq0y1GbP1Q3NQ9pudmWqfqWxtLjZyEBPTkJ9g5ltFHoG569XXzbVzmq1aIxizILbxfCiJZ', '_8wBe8z0kOo', 'mfzfGGPne1', 'GmI2M03612', '_8MaCUfAOgC'
Source: imagelogger.0.dr, 5d5M6UPj5GkFOQYeqNDALKVMzAe60umRAMqpJQyhB6Wr8WEnIMYJIqtX2lIBwb4Ew.cs	High entropy of concatenated method names: 't0BrpmAMBQObySLJZ5SHZSY9GHgV48pVpShl1kuxGmhTgOqLHEmnE07FeaIUSnM02', 'm0j6o5tD9QQXQvFyWlEy4HzG4ACa9ITotrohyc6K1Zk8D6gsLRg514RRexzcZl1fY', 'tT8jdxeN16arHRLQyJKpGUFJOszyxPfAoISq8A7mitfRouvlnmkmkz27kHqM85Emy', 'mFbODUCE8dpKW9AR5nVBndnjb3yLLHXZX0zEBgmqhMsxNKqyiV', 'rSXFd9o5nGCtSWajz4F0jn84lN1zDs4QKCtsiYZoUuGHntHMZA', 'K0N84TNour9CLwqVGnVmYgkSA8lKXA3hsF1ZBjTR7Knjm6PkII', 'lCpz2FFAEWWQSyZwa0eNlTt6sfL2benCAWRvPA3dv3lKhwbvY3', 'BzcL6rbPioJuBF5eklmx526SFWYn0AMD4oJ7mYZWOpYITit5WR', 'QywiyVPJ8m9lvIXw6Mti0AuUJDA2mSU0tuAw3oAejjSlQM7pbQ', 'MtxbmVO8XOmJr3inJsWvpd9mYJCPUq9hUB6U7H8ljZQYUW8JUZ'
Source: imagelogger.0.dr, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	High entropy of concatenated method names: 'ZRIsfo0V1spJfGDtUf8dSoMQgVYLuz1rnLJKAnK1U0GhZbBq42', '_3aMDbZ2q9e20BmZEhIaJt6XlXm5UJhLKFpFQN49bCAjEUKABU4', 'BxN2FLjOWZDzBH5bLtgYmJqRF6C5T5cGazEdfHcn8ZI22nuWdB', 'KfOsm4kFLGAEdhc33hOLO132StxtaXF8wEQJdC800FLNbytrS8', 'sgif8D08CSsyeOD7aYFmeF60RZsfuOE9qVqHpmJgGZTIJZbgCA', 'vttQD75kDGiceC5WBSry2w1mQ4vqHsXs6B9e0rnKFmtFSmkmHW', 'nCHVTlnALkhlGRnPg8KuFukEWjnWBiTZJdROj6j2zlk3AS5Bt7', 'PPWozYnItdDIat0WNDwRWFXQRmilw2RHem6oQ4Eap1KEMtSUSc', 'ZzHGkqlfneKc9axyxzoJiqJdiuGfz9TcwEKKqDYCoa8oVP6oML', 'NnlRXBx3RxlQimLoiBIInKmhL71dh1B8tCet1JjjwKYQnstxOD'
Source: imagelogger.0.dr, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	High entropy of concatenated method names: 'mHTAb9BI4irvmiRltQrnwimEm', 'Jm6HacNyF4NnJaP2xFwNPFp3p', 'E7W4z6SnvbN6BykbMeXkHzJ9Z', 'M5xD61rMj4IIuhi0JLJU6T2JX', 'i8pbxD6vQuQpTDl5F1DsF2eoX', 'Xzwtbf7NUv2JuF7qSQ1vvuzmO', 'LkDQ0SqvnbgYpr06sZPUDUHgG', '_1bPapUWnAMMbbbBMQebBRCb8X', 'aJAIdEMQXqmtwMWpIxXaFTe9P', 'kUisE9idkGaPkAYlExoFAx5qW'
Source: imagelogger.0.dr, FhrwYiRTRf2VDyM59kmulbyU2.cs	High entropy of concatenated method names: 'nQtJxtWE0d3JO6W4O2FiT0jJe', 'qpPIeuuyevTg3ZI0Ea1Ctui1o', 'Moq2nmPwCP9cbjFNPGH2hHiL1', 'mV5DPAK60gzly7fLERlkR2FgB', 'eHS0HYtDbc', '_0qXwHtIvIk', 'LZtYzkaDWK', 'V4q16VWCi2', 'UxJpbFKhjE', 'vJy7dElNqI'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, iKJ4AENNa8mLOwx6LzIjB1mfK.cs	High entropy of concatenated method names: 'nC0yQUxeBXWwbCn2oEsKG8h2c', 'WM8OMu8NW0st6cj12D1kCuuSN', 't0r1qJNm57sGGY0Lo3CiY1c61', '_01rIKLg4oD', 'MV5FRB5ztA', 'c1TtQhPnv5Yxq7HmN9AYJhxdPXQQj8q8QvCRRHHYl32', 'mNqw4QzXRPzNN2X4AVMMZ6koduHt21Bb7W3E7pgCo6i', 'U9vIMA5aR1jivNIpEfRpYRKK0smFebdlZHNAQRxWXkY', 'U4c3HJaF6uWTSOzvNTtone5R8uxjwpBZbAwvu8GiqMo', 'sGtMU9I0UPZWFYbjnx3UBLUXdOj9H6lmbGKwSU7F3el'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, AXuwpxT6b3Dw8vjCODBlVC9HxBkD0z5qa2n9W88sRGTmHwNhJV.cs	High entropy of concatenated method names: '_9rPtYGRERqFQvVrbzQmj2bGLFE9HC4TvV39rcJkRRiNGX2QzCj', 'Rh0goXkSWFbkOaXSLoOXl7VE3hBxuE527s0Vo2vHfzx5J29XhA', '_5V5HQHjlqlXaQadQAeJt8bK8U0niy8Ef7AOvPhvmwDah4LUWg2', 'qLGSXU8VFblvvVhBOryozoQaY3U5tA0kXgdwR5mlmJaPvb4kik', 'lwVjD1vbHzdvylMr6uiuUAEvaN7DlxkJF9iXLAoleC9kHYLEXv', 'XAKpGZcAGjjnpWeCmD3ZtWZuwqznUe9LILhnADGiIuipy7Ccf2', 'EsH3qgp7pkAt7uaa1c81LvVV5LVlunZdyxBYJuu0f9uOSRIXbj', 'ZgL62uslYzditFt64DuHZnrJAy4cb5oFq8pORuMeeQiaDDhf0O53fXXPu1E9VvRHcgbmVsiTEuYDQq9z1Pu', 's2rWrpr1Sukp40kBxMV66NPfnaaOsCDJHlS4vSWwPUq4M6AIAQxe2AjmSjLqBEGi26FywfybF1SsaABe22h', 'rqF6szm3zNjsTa24gavKwQe4sgVMXosbfcGSOeSKvKF8mz0lKYLVgq2aeZHe5wOan3MaYLNNiNUtBnPOWBs'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, FyZqVu9h9CsbV1aafmGwZ44IEsxosU9Beg1nA2HahTn3k0bQySpC5E60vqnHHztAe1FVjwYJEfE67Bh42OD.cs	High entropy of concatenated method names: 'AddClipboardFormatListener', 'SetParent', 'JAsLW9da6RO33ELvCfP0JggQHRI60tuQj5YEXhkLFfg7h0MKHxBC82B8kJNXXUeszYzSQSocu1k2YMHfOHW', 'XYjsGaruuR', 'Jo9e9fOAnS', '_9cfY7EEETc', '_12cS8MFqK0'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, 6coZ22sBrCOss4k7p3VZM9puHdz8RszCObd8aBYgrrjj8EE2ynlgAbUzL7Yy61NekVlmf16HICMU9m5WWnW.cs	High entropy of concatenated method names: 'uTcvL4HbodJUCfqMhQ6HmndkAPRoLR1pilq7SZDxrLKjGUKwFxs9RMYSlipiswRf8B8bKHBNQvu0y29R6jS', 'SxnOjnEX53', 'ZVnpRUyERH', 'bJttju9KnW', 'tsmHl4044f'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, qh407p2eG1CMRhpADi7tfM32osPWCEqBZPr01IEWBGGCUBSw61I5ngw21nKtDcGkIBLoAtEC3URLcgT9ORn.cs	High entropy of concatenated method names: 'GNP9uwbibPaD3ssHD6APyDLs7uLXZOLx4i7QKNbCyiC37ODnskXGXVUiCBvF9h1cGqGF7NqP5RNPlywCK1Y', 'Fy6RrcX8g8n01Fq0y1GbP1Q3NQ9pudmWqfqWxtLjZyEBPTkJ9g5ltFHoG569XXzbVzmq1aIxizILbxfCiJZ', '_8wBe8z0kOo', 'mfzfGGPne1', 'GmI2M03612', '_8MaCUfAOgC'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, 5d5M6UPj5GkFOQYeqNDALKVMzAe60umRAMqpJQyhB6Wr8WEnIMYJIqtX2lIBwb4Ew.cs	High entropy of concatenated method names: 't0BrpmAMBQObySLJZ5SHZSY9GHgV48pVpShl1kuxGmhTgOqLHEmnE07FeaIUSnM02', 'm0j6o5tD9QQXQvFyWlEy4HzG4ACa9ITotrohyc6K1Zk8D6gsLRg514RRexzcZl1fY', 'tT8jdxeN16arHRLQyJKpGUFJOszyxPfAoISq8A7mitfRouvlnmkmkz27kHqM85Emy', 'mFbODUCE8dpKW9AR5nVBndnjb3yLLHXZX0zEBgmqhMsxNKqyiV', 'rSXFd9o5nGCtSWajz4F0jn84lN1zDs4QKCtsiYZoUuGHntHMZA', 'K0N84TNour9CLwqVGnVmYgkSA8lKXA3hsF1ZBjTR7Knjm6PkII', 'lCpz2FFAEWWQSyZwa0eNlTt6sfL2benCAWRvPA3dv3lKhwbvY3', 'BzcL6rbPioJuBF5eklmx526SFWYn0AMD4oJ7mYZWOpYITit5WR', 'QywiyVPJ8m9lvIXw6Mti0AuUJDA2mSU0tuAw3oAejjSlQM7pbQ', 'MtxbmVO8XOmJr3inJsWvpd9mYJCPUq9hUB6U7H8ljZQYUW8JUZ'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, P0zmgyAwIzWS1SNemBwKeisRM0m5a2gCpdQrDHNEpHWYooGu9s.cs	High entropy of concatenated method names: 'ZRIsfo0V1spJfGDtUf8dSoMQgVYLuz1rnLJKAnK1U0GhZbBq42', '_3aMDbZ2q9e20BmZEhIaJt6XlXm5UJhLKFpFQN49bCAjEUKABU4', 'BxN2FLjOWZDzBH5bLtgYmJqRF6C5T5cGazEdfHcn8ZI22nuWdB', 'KfOsm4kFLGAEdhc33hOLO132StxtaXF8wEQJdC800FLNbytrS8', 'sgif8D08CSsyeOD7aYFmeF60RZsfuOE9qVqHpmJgGZTIJZbgCA', 'vttQD75kDGiceC5WBSry2w1mQ4vqHsXs6B9e0rnKFmtFSmkmHW', 'nCHVTlnALkhlGRnPg8KuFukEWjnWBiTZJdROj6j2zlk3AS5Bt7', 'PPWozYnItdDIat0WNDwRWFXQRmilw2RHem6oQ4Eap1KEMtSUSc', 'ZzHGkqlfneKc9axyxzoJiqJdiuGfz9TcwEKKqDYCoa8oVP6oML', 'NnlRXBx3RxlQimLoiBIInKmhL71dh1B8tCet1JjjwKYQnstxOD'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, xFEI6GFflrDoYGq8T7NvZ6oxo.cs	High entropy of concatenated method names: 'mHTAb9BI4irvmiRltQrnwimEm', 'Jm6HacNyF4NnJaP2xFwNPFp3p', 'E7W4z6SnvbN6BykbMeXkHzJ9Z', 'M5xD61rMj4IIuhi0JLJU6T2JX', 'i8pbxD6vQuQpTDl5F1DsF2eoX', 'Xzwtbf7NUv2JuF7qSQ1vvuzmO', 'LkDQ0SqvnbgYpr06sZPUDUHgG', '_1bPapUWnAMMbbbBMQebBRCb8X', 'aJAIdEMQXqmtwMWpIxXaFTe9P', 'kUisE9idkGaPkAYlExoFAx5qW'
Source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, FhrwYiRTRf2VDyM59kmulbyU2.cs	High entropy of concatenated method names: 'nQtJxtWE0d3JO6W4O2FiT0jJe', 'qpPIeuuyevTg3ZI0Ea1Ctui1o', 'Moq2nmPwCP9cbjFNPGH2hHiL1', 'mV5DPAK60gzly7fLERlkR2FgB', 'eHS0HYtDbc', '_0qXwHtIvIk', 'LZtYzkaDWK', 'V4q16VWCi2', 'UxJpbFKhjE', 'vJy7dElNqI'

Source: C:\Users\user\Desktop\imagelogger.exe

File created: C:\Users\user\AppData\Local\Temp\imagelogger

Jump to dropped file

Source: C:\Users\user\Desktop\imagelogger.exe

File created: C:\Users\user\AppData\Local\Temp\imagelogger

Jump to dropped file

Source: C:\Users\user\Desktop\imagelogger.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: imagelogger.exe, imagelogger.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\imagelogger.exe	Memory allocated: 28C0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Memory allocated: 1AA90000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe	Window / User API: threadDelayed 7520			Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Window / User API: threadDelayed 2336			Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe TID: 2960

Thread sleep time: -3689348814741908s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: imagelogger.0.dr	Binary or memory string: vmware
Source: imagelogger.exe, 00000000.00000002.3787830035.000000001B91C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\imagelogger.exe

Code function: 0_2_00007FF887B07301 CheckRemoteDebuggerPresent,

0_2_00007FF887B07301

Source: C:\Users\user\Desktop\imagelogger.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe	Queries volume information: C:\Users\user\Desktop\imagelogger.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\imagelogger.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\imagelogger.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: imagelogger.exe, 00000000.00000002.3787830035.000000001B91C000.00000004.00000020.00020000.00000000.sdmp, imagelogger.exe, 00000000.00000002.3785635722.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, imagelogger.exe, 00000000.00000002.3787830035.000000001B8F2000.00000004.00000020.00020000.00000000.sdmp, imagelogger.exe, 00000000.00000002.3787830035.000000001B9C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\imagelogger.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: imagelogger.exe, type: SAMPLE
Source: Yara match	File source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.imagelogger.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.imagelogger.exe.12aa1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3786146895.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: imagelogger.exe PID: 3820, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\imagelogger, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: imagelogger.exe, type: SAMPLE
Source: Yara match	File source: 0.2.imagelogger.exe.12aa1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.imagelogger.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.imagelogger.exe.12aa1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3786146895.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: imagelogger.exe PID: 3820, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\imagelogger, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	11 Masquerading	OS Credential Dumping	541 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	151 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	151 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
imagelogger.exe	75%	Virustotal		Browse
imagelogger.exe	76%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
imagelogger.exe	100%	Avira	HEUR/AGEN.1311620
imagelogger.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\imagelogger	100%	Avira	HEUR/AGEN.1311620
C:\Users\user\AppData\Local\Temp\imagelogger	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\imagelogger	76%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
among-publication.at.ply.gg	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
among-publication.at.ply.gg	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
among-publication.at.ply.gg	147.185.221.229	true	true	4%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
among-publication.at.ply.gg	true	Avira URL Cloud: malware	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	imagelogger.exe, 00000000.00000002.3786146895.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
147.185.221.229	among-publication.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575694
Start date and time:	2024-12-16 08:36:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	imagelogger.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 6 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:37:26	API Interceptor	13578621x Sleep call for process: imagelogger.exe modified
07:37:28	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	com surrogate.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	ip-api.com/line/?fields=hosting
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	ip-api.com/line/?fields=hosting
	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	ip-api.com/json/
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	ip-api.com/line/?fields=hosting
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
147.185.221.229	Fast Download.exe	Get hash	malicious	Njrat	Browse
	cheker.exe	Get hash	malicious	Orcus	Browse
	CheatsCheker.exe	Get hash	malicious	Orcus	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	208.95.112.1
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	208.95.112.1
	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	208.95.112.1
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	208.95.112.1
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
s-part-0035.t-0009.t-msedge.net	Ex.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	installer.exe.exe	Get hash	malicious	Quasar	Browse	13.107.246.63
	Neverlose Loader.exe	Get hash	malicious	Quasar	Browse	13.107.246.63
	vanilla.exe	Get hash	malicious	Quasar	Browse	13.107.246.63
	Fast Download.exe	Get hash	malicious	Njrat	Browse	13.107.246.63
	Client.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	backd00rhome.exe	Get hash	malicious	Metasploit	Browse	13.107.246.63
	fern_wifi_recon%2.34.exe	Get hash	malicious	Metasploit	Browse	13.107.246.63
	CrSpoofer.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.63
	ImageMso.Gallery.xll	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	com surrogate.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	lastest.exe	Get hash	malicious	Njrat	Browse	147.185.221.20
	Fast Download.exe	Get hash	malicious	Njrat	Browse	147.185.221.229
	cnct.exe	Get hash	malicious	Njrat	Browse	147.185.221.20
	Server1.exe	Get hash	malicious	Njrat	Browse	147.185.221.17
	njSilent.exe	Get hash	malicious	Njrat	Browse	147.185.221.19
	Minet.exe	Get hash	malicious	Njrat	Browse	147.185.221.22
	Discordd.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	Discord2.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	Discord3.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
TUT-ASUS	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	https://fsharetv.io	Get hash	malicious	Unknown	Browse	162.252.214.4
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	208.95.112.1
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	208.95.112.1
	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	208.95.112.1
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\imagelogger.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	327680
Entropy (8bit):	3.402515961281467
Encrypted:	false
SSDEEP:	3072:Bm4cvA/SDhVUYbg1Sc0dBYOzY4Xy0tv4L9witTOs/sh/A:oVTbGSldBSf0tvg3xs/
MD5:	9655B8120C0D0469EE87EEBDEECA3B4D
SHA1:	88694919A39988857213BDE785B5C591E1525A35
SHA-256:	D5355284B6411903AB344C3DA20178FF2891B7C14B2CECF27943C9331E6FE652
SHA-512:	AA418C5AB153B3FAD305D6556990C2BB89ED59E8AC11F84D5CEBEA547032387CCB9211FB4D35486534D205194884ABFCC5CFB84417196C3A9FF886E97346B306
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\imagelogger, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\imagelogger, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\imagelogger, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F..d.....................(......N.... ........@.. .......................`............@.....................................S........%...................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc....%.......&..................@..@.reloc.......@......................@..B................0.......H.......H^..........&.....................................................(.....r...p. '(....(.....r5..p. .Q..s.........s.........s.........s..........rK..p. ..e..ra..p. qP...rw..p. .x!..r...p. ..\|..r...p. ......((....r...p. 5....r...p. .M^..(...-.(+...,.+.(,...,.+.()...,.+.((...,..(H..."(....+.&(....&+..+5sZ... .... .'..o[...(...~....-.(\...(N...~....o\...&.-..r...p. O....r...p. wr...r...p. .+...r...p. '^...r%..p. .....r;..p. .(T..rQ.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk

Download File

Process:	C:\Users\user\Desktop\imagelogger.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Dec 16 06:37:25 2024, mtime=Mon Dec 16 06:37:25 2024, atime=Mon Dec 16 06:37:25 2024, length=327680, window=hide
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.992986568846722
Encrypted:	false
SSDEEP:	24:8RRHDHo73qKRSgK3RerGAcwZlEI4iAOqygm:8RVrK3qKR/cwZLCLyg
MD5:	53E4E9CF775219938FB216846D3D501F
SHA1:	5921A8E57E160DB4268546A76ABD9E55DD7C9582
SHA-256:	422DB0468F90AE3C204883D75B64000328547BF9903840AB8863B471D9222EA2
SHA-512:	B27B50B24D5C79F20E1A4F1BF5ABC801EB249371242BBD81F0771B887503693C3F11AD886E0473FA4097F8FF87A9C19F2AB3F2C2A78C44DEECA4F00811E05CAA
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...<.%Z.O..<.%Z.O..<.%Z.O............................:..DG..Yr?.D..U..k0.&...&.......bBDj...@k/R.O...n/Z.O......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.Y.<..........................=...A.p.p.D.a.t.a...B.P.1......Y.<..Local.<......EWsG.Y.<.............................L.o.c.a.l.....N.1......Y.<..Temp..:......EWsG.Y.<.............................T.e.m.p.....`.2......Y.< .IMAGEL~1..H......Y.<.Y.<.............................i.m.a.g.e.l.o.g.g.e.r.......[...............-.......Z............D.c.....C:\Users\user\AppData\Local\Temp\imagelogger..(.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.i.m.a.g.e.l.o.g.g.e.r.............:...........\|....I.J.H..K..:...`.......X.......035347...........hT..CrF.f4... ...E._c...,...E...hT..CrF.f4... ...E._c...,...E..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9...1SPS..mD..pH

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.402515961281467
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	imagelogger.exe
File size:	327'680 bytes
MD5:	9655b8120c0d0469ee87eebdeeca3b4d
SHA1:	88694919a39988857213bde785b5c591e1525a35
SHA256:	d5355284b6411903ab344c3da20178ff2891b7c14b2cecf27943c9331e6fe652
SHA512:	aa418c5ab153b3fad305d6556990c2bb89ed59e8ac11f84d5cebea547032387ccb9211fb4d35486534d205194884abfcc5cfb84417196c3a9ff886e97346b306
SSDEEP:	3072:Bm4cvA/SDhVUYbg1Sc0dBYOzY4Xy0tv4L9witTOs/sh/A:oVTbGSldBSf0tvg3xs/
TLSH:	936408D63B4043EFC05ABF798965D631A2BA5F46FA46E346C074F051AFB71C28E41AC2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F..d.....................(......N.... ........@.. .......................`............@................................

File Icon


Icon Hash:	17137171652d0303

Static PE Info

General

Entrypoint:	0x40f54e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64F7BE46 [Tue Sep 5 23:48:22 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf4f8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10000	0x425aa	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd554	0xd600	7f0e7e46e5770e2d36f35037f62679b0	False	0.5971086448598131	data	6.1236544264430695	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x10000	0x425aa	0x42600	9883ae93da2a2082c3c7fe7f8ae676ad	False	0.1864811381826742	data	2.3894491698434708	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0xc	0x200	7ee00025a62cea4fff5885e1822b5ff8	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x10130	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 11811 x 11811 px/m	0.18493875196023316
RT_GROUP_ICON	0x52158	0x14	data	0.9
RT_VERSION	0x5216c	0x254	data	0.4664429530201342
RT_MANIFEST	0x523c0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T08:37:38.443741+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.9	49723	147.185.221.229	42209	TCP
2024-12-16T08:39:03.103686+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.9	49897	147.185.221.229	42209	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 08:37:24.558048964 CET	49717	80	192.168.2.9	208.95.112.1
Dec 16, 2024 08:37:24.677905083 CET	80	49717	208.95.112.1	192.168.2.9
Dec 16, 2024 08:37:24.678037882 CET	49717	80	192.168.2.9	208.95.112.1
Dec 16, 2024 08:37:24.679280996 CET	49717	80	192.168.2.9	208.95.112.1
Dec 16, 2024 08:37:24.799031019 CET	80	49717	208.95.112.1	192.168.2.9
Dec 16, 2024 08:37:25.830826998 CET	80	49717	208.95.112.1	192.168.2.9
Dec 16, 2024 08:37:25.876678944 CET	49717	80	192.168.2.9	208.95.112.1
Dec 16, 2024 08:37:27.491365910 CET	49723	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:27.611377001 CET	42209	49723	147.185.221.229	192.168.2.9
Dec 16, 2024 08:37:27.615473986 CET	49723	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:27.689527035 CET	49723	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:27.809324026 CET	42209	49723	147.185.221.229	192.168.2.9
Dec 16, 2024 08:37:38.443741083 CET	49723	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:38.563544989 CET	42209	49723	147.185.221.229	192.168.2.9
Dec 16, 2024 08:37:49.190136909 CET	49723	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:49.310051918 CET	42209	49723	147.185.221.229	192.168.2.9
Dec 16, 2024 08:37:49.506159067 CET	42209	49723	147.185.221.229	192.168.2.9
Dec 16, 2024 08:37:49.506239891 CET	49723	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:51.596060991 CET	49723	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:51.597423077 CET	49781	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:51.715868950 CET	42209	49723	147.185.221.229	192.168.2.9
Dec 16, 2024 08:37:51.717488050 CET	42209	49781	147.185.221.229	192.168.2.9
Dec 16, 2024 08:37:51.717596054 CET	49781	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:52.072165966 CET	49781	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:37:52.192792892 CET	42209	49781	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:06.142893076 CET	49781	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:06.262756109 CET	42209	49781	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:13.601051092 CET	42209	49781	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:13.601176977 CET	49781	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:14.033478975 CET	49781	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:14.034941912 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:14.153239012 CET	42209	49781	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:14.154623032 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:14.154712915 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:14.193061113 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:14.312966108 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:17.542336941 CET	80	49717	208.95.112.1	192.168.2.9
Dec 16, 2024 08:38:17.542484045 CET	49717	80	192.168.2.9	208.95.112.1
Dec 16, 2024 08:38:26.783673048 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:26.903461933 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:32.642879009 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:32.762799025 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:32.799338102 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:32.919294119 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:33.236546040 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:33.356230974 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:34.935174942 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:35.054971933 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:36.056226969 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:36.056363106 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:41.064493895 CET	49831	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:41.067009926 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:41.184241056 CET	42209	49831	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:41.186774969 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:41.186842918 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:41.225881100 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:41.347587109 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:41.347651005 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:41.467551947 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:41.611836910 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:41.731656075 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:43.049915075 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:43.169678926 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:45.221295118 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:45.340990067 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:49.658552885 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:49.778362989 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:51.768091917 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:51.888159037 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:51.889703035 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:52.009682894 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:52.066692114 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:52.186394930 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:38:57.533638954 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:38:57.653347015 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:02.863879919 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:02.983685017 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:02.983747959 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:03.103636026 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:03.103686094 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:03.117934942 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:03.118036985 CET	49897	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:03.223421097 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:03.237713099 CET	42209	49897	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:05.848567009 CET	49717	80	192.168.2.9	208.95.112.1
Dec 16, 2024 08:39:05.968352079 CET	80	49717	208.95.112.1	192.168.2.9
Dec 16, 2024 08:39:08.010214090 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:08.129966974 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:08.130168915 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:08.231005907 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:08.350754976 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:08.814901114 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:08.934542894 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:08.935065031 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:09.054797888 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:09.441689968 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:09.561634064 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:15.521704912 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:15.641444921 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:19.221657038 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:19.341397047 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:24.627876043 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:24.747582912 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:27.799350023 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:27.919087887 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:29.801759005 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:29.921528101 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:30.025727987 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:30.025810003 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:34.820108891 CET	49958	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:34.855384111 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:34.940001965 CET	42209	49958	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:34.977869034 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:34.984981060 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:35.256619930 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:35.378602028 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:40.393264055 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:40.513750076 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:40.513823032 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:40.633606911 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:40.633660078 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:40.753469944 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:47.565356970 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:47.685133934 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:47.986881971 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:48.106875896 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:52.989836931 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:53.109888077 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:56.080990076 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:56.201327085 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:56.201395035 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:56.321185112 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:56.321266890 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:56.443036079 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:56.443123102 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:56.563020945 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:56.563093901 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:39:56.683120012 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:56.902080059 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:39:56.902151108 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:01.549258947 CET	49982	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:01.552069902 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:01.669336081 CET	42209	49982	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:01.671950102 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:01.672137976 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:01.880186081 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:01.999938965 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:05.519886971 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:05.639708042 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:06.971414089 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:07.091229916 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:07.092050076 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:07.211896896 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:12.038858891 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:12.347939014 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:12.437491894 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:12.467814922 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:12.846978903 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:12.967247009 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:12.967310905 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:13.087390900 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:13.087567091 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:13.207426071 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:17.409210920 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:17.528978109 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:18.206034899 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:18.325894117 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:18.325956106 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:18.445769072 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:18.445971012 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:18.565788031 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:18.565849066 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:18.685570955 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:18.685628891 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:18.805362940 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:23.577688932 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:23.582071066 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:23.585140944 CET	49983	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:23.588009119 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:23.705022097 CET	42209	49983	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:23.707845926 CET	42209	49984	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:23.708292007 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:23.866831064 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:23.986601114 CET	42209	49984	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:35.161978006 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:35.281685114 CET	42209	49984	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:36.815787077 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:36.936012030 CET	42209	49984	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:38.675096989 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:38.794795990 CET	42209	49984	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:45.625212908 CET	42209	49984	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:45.625310898 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:49.033998013 CET	49984	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:49.036628008 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:49.153773069 CET	42209	49984	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:49.156349897 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:49.157160044 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:49.437100887 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:49.556936979 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:54.534167051 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:54.654119015 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:40:54.654190063 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:40:54.774199009 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:05.518482924 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:05.638283014 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:07.409130096 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:07.529082060 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:11.047552109 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:11.047631979 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:14.940289021 CET	49985	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:14.942884922 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:15.060118914 CET	42209	49985	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:15.062978029 CET	42209	49986	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:15.063090086 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:15.099416018 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:15.222165108 CET	42209	49986	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:18.596782923 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:18.716449022 CET	42209	49986	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:20.018579006 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:20.138335943 CET	42209	49986	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:26.815496922 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:26.935457945 CET	42209	49986	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:36.970113039 CET	42209	49986	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:36.970267057 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:40.643378973 CET	49986	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:40.644553900 CET	49987	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:40.763128996 CET	42209	49986	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:40.764360905 CET	42209	49987	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:40.768491030 CET	49987	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:40.793423891 CET	49987	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:40.913333893 CET	42209	49987	147.185.221.229	192.168.2.9
Dec 16, 2024 08:41:54.362462044 CET	49987	42209	192.168.2.9	147.185.221.229
Dec 16, 2024 08:41:54.482134104 CET	42209	49987	147.185.221.229	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 08:37:24.411652088 CET	49513	53	192.168.2.9	1.1.1.1
Dec 16, 2024 08:37:24.551023960 CET	53	49513	1.1.1.1	192.168.2.9
Dec 16, 2024 08:37:27.197638035 CET	62036	53	192.168.2.9	1.1.1.1
Dec 16, 2024 08:37:27.472388029 CET	53	62036	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 08:37:24.411652088 CET	192.168.2.9	1.1.1.1	0x5022	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 08:37:27.197638035 CET	192.168.2.9	1.1.1.1	0xf24c	Standard query (0)	among-publication.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 08:37:19.105788946 CET	1.1.1.1	192.168.2.9	0xe188	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 08:37:19.105788946 CET	1.1.1.1	192.168.2.9	0xe188	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 16, 2024 08:37:24.551023960 CET	1.1.1.1	192.168.2.9	0x5022	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 08:37:27.472388029 CET	1.1.1.1	192.168.2.9	0xf24c	No error (0)	among-publication.at.ply.gg		147.185.221.229	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	208.95.112.1	80	3820	C:\Users\user\Desktop\imagelogger.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 08:37:24.679280996 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 16, 2024 08:37:25.830826998 CET	175	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 07:37:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	02:37:19
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\imagelogger.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\imagelogger.exe"
Imagebase:	0x780000
File size:	327'680 bytes
MD5 hash:	9655B8120C0D0469EE87EEBDEECA3B4D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1327178252.0000000000782000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.3787439473.0000000012A91000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3786146895.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF887B010FA Relevance: 14.5, Strings: 11, Instructions: 755
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0Dp, xrefs: 00007FF887B017D4
3L_^, xrefs: 00007FF887B01101
6f, xrefs: 00007FF887B016F3
8Mp, xrefs: 00007FF887B0172E
0Dp, xrefs: 00007FF887B01825
6f, xrefs: 00007FF887B01657
6f, xrefs: 00007FF887B015C7
6f, xrefs: 00007FF887B0150A
0Dp, xrefs: 00007FF887B01764
"rf, xrefs: 00007FF887B0152E
L_H, xrefs: 00007FF887B0176E

Memory Dump Source

Source File: 00000000.00000002.3788662126.00007FF887B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b00000_imagelogger.jbxd

Similarity

API ID:
String ID: 6f$6f$6f$6f$L_H$"rf$0Dp$0Dp$0Dp$3L_^$8Mp
API String ID: 0-3355891241
Opcode ID: 6ef2a1494ad0edec26e17e7c12dc89c8103a14124e372ea9107952c45077383d
Instruction ID: 8a78f44fbc70c4896cae4d09a096eb1422e71a585866a2dc86ca8816f0b98844
Opcode Fuzzy Hash: 6ef2a1494ad0edec26e17e7c12dc89c8103a14124e372ea9107952c45077383d
Instruction Fuzzy Hash: D932E431B68A095BEB58FB7C945A2FD77E2FF98390F440579D04DD3292DE28A841C782

Function 00007FF887B01C11 Relevance: 5.4, Strings: 4, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6f, xrefs: 00007FF887B01D2B
6f, xrefs: 00007FF887B01EC2
6f, xrefs: 00007FF887B01DE2
6f, xrefs: 00007FF887B01C80

Memory Dump Source

Source File: 00000000.00000002.3788662126.00007FF887B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b00000_imagelogger.jbxd

Similarity

API ID:
String ID: 6f$6f$6f$6f
API String ID: 0-1167845655
Opcode ID: f2348884848170ca671df4e9ae1eafba2af17fce4d4a9378774a57eae9ea1f45
Instruction ID: 2ca110629f63d5ea7228b432476d1b81a5781ad619287ad46be152fedefe2db6
Opcode Fuzzy Hash: f2348884848170ca671df4e9ae1eafba2af17fce4d4a9378774a57eae9ea1f45
Instruction Fuzzy Hash: C6C17030F5C94D8FEB98EB6C84657BD76E2FF99384F044579D04ED3292DE28A8428742

Function 00007FF887B07301 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FF887B073B0

Memory Dump Source

Source File: 00000000.00000002.3788662126.00007FF887B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b00000_imagelogger.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 21a2bd0adefae163ff31386e0bcb1f739edcc38ee528728285598a04dfe6188c
Instruction ID: 4434448930417c960feac69fd861554d7303f74bd60d1c6b45cbd7fe2b97d5d2
Opcode Fuzzy Hash: 21a2bd0adefae163ff31386e0bcb1f739edcc38ee528728285598a04dfe6188c
Instruction Fuzzy Hash: 8A31FF319086188FCB58DF58C88A7ED7BF0EF65321F0542AAD489D7252DB34A846CB91

Function 00007FF887B05D56 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788662126.00007FF887B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b00000_imagelogger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71297c6b52a4faa124b9bc5ab67ee8fc2281742535e2cf25fb023b18f6c3ce9b
Instruction ID: 6d5d41068ccaffcd709f28b006933a25aed0cce165376b1e67ba69a2edda40d2
Opcode Fuzzy Hash: 71297c6b52a4faa124b9bc5ab67ee8fc2281742535e2cf25fb023b18f6c3ce9b
Instruction Fuzzy Hash: EDF1A330918A4D8FEBA8DF28C855BED37E1FF55350F04426AE84DC7691DB38A945CB82

Function 00007FF887B06B02 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3788662126.00007FF887B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b00000_imagelogger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1917e4c9a72671dd3cecf5eca3c835beccffda524fc9bc956604502841b99015
Instruction ID: bf9ae2882a2cfd34a1a0eef4dde4bccebddadf1c08d5eefad2cc6416071c1a43
Opcode Fuzzy Hash: 1917e4c9a72671dd3cecf5eca3c835beccffda524fc9bc956604502841b99015
Instruction Fuzzy Hash: 13E1A230908A4E8FEBA8DF28C8557E977E2FF55350F04426ED84DC7291DB78A945CB82

Function 00007FF887B08BBD Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FF887B08C92

Memory Dump Source

Source File: 00000000.00000002.3788662126.00007FF887B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b00000_imagelogger.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 3a5cf00e790a9427521a6e6c5266be897ce1c69169373347fcec51bec62db1d3
Instruction ID: 720deff5d751317e75ad4ef0b43e8713c25e1cca60cc6d6f7bf8cd5e5aea7932
Opcode Fuzzy Hash: 3a5cf00e790a9427521a6e6c5266be897ce1c69169373347fcec51bec62db1d3
Instruction Fuzzy Hash: 2541C23190C6498FDB19DBA8D845BE9BBF0EF56311F04416ED08AD3692CB68A446CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report imagelogger.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\imagelogger

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\imagelogger.lnk

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
imagelogger.exe

Function 00007FF887B010FA Relevance: 14.5, Strings: 11, Instructions: 755
COMMON

Function 00007FF887B01C11 Relevance: 5.4, Strings: 4, Instructions: 388
COMMON

Function 00007FF887B07301 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Function 00007FF887B08BBD Relevance: 1.6, APIs: 1, Instructions: 143
COMMON