Windows Analysis Report
gfehgfwveg.exe

AI detected suspicious sample

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Machine Learning detection for sample

Source: gfehgfwveg.exe

Joe Sandbox ML: detected

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302E190 FindFirstFileW,FindClose,		0_2_0302E190
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302DBC4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,		0_2_0302DBC4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49830 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49831 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49838 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49835 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49981 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49988 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49991 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49985 -> 34.169.99.17:443

Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS

Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103

Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: gfehgfwveg.exe, 00000000.00000002.3889930307.000000006E66F000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063469000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2080229872.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2075649868.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: gfehgfwveg.exe, 00000000.00000003.2074901686.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: gfehgfwveg.exe, 00000000.00000003.2074901686.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

E-Banking Fraud

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E525C LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

0_2_034E525C

Source: gfehgfwveg.exe

Static PE information: Number of sections : 11 > 10

Source: gfehgfwveg.exe, 00000000.00000002.3889930307.000000006E66F000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063469000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000003.2080229872.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000002.3881473973.00000000025D8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000003.2075649868.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000002.3886606090.0000000003824000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs gfehgfwveg.exe

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal88.troj.evad.winEXE@6/0@0/4

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2876:120:WilError_03

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: gfehgfwveg.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\gfehgfwveg.exe "C:\Users\user\Desktop\gfehgfwveg.exe"
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

May use the Tor software to hide its network traffic

Source: gfehgfwveg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gfehgfwveg.exe

Static file information: File size 4276224 > 1048576

Source: gfehgfwveg.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3ec600

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E525C LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

0_2_034E525C

Source: gfehgfwveg.exe

Static PE information: section name: .didata

Hooking and other Techniques for Hiding and Protection

Source: gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2071863727.000000007E870000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Window / User API: threadDelayed 9217			Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Window / User API: threadDelayed 783			Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302E190 FindFirstFileW,FindClose,		0_2_0302E190
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302DBC4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,		0_2_0302DBC4

Source: gfehgfwveg.exe, 00000000.00000003.2082354644.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: gfehgfwveg.exe, 00000000.00000002.3880702296.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\gfehgfwveg.exe

API call chain: ExitProcess graph end node

graph_0-2563

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E525C LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

0_2_034E525C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2071863727.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2071863727.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,		0_2_0302E2C8
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		0_2_0302D768

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E583C GetVersionExW,GetVersionExW,LoadLibraryW,

0_2_034E583C

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	153 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
gfehgfwveg.exe	55%	ReversingLabs	Win32.Trojan.Danabot
gfehgfwveg.exe	100%	Avira	TR/ATRAPS.Gen
gfehgfwveg.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
http://html4/loose.dtd	gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.htmlRAND	gfehgfwveg.exe, 00000000.00000003.2074901686.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063281000.00000040.00001000.00020000.00000000.sdmp	false	high
http://.css	gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/V	gfehgfwveg.exe, 00000000.00000002.3889930307.000000006E66F000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063469000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2080229872.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2075649868.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.jpg	gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.html	gfehgfwveg.exe, 00000000.00000003.2074901686.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063281000.00000040.00001000.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
35.195.45.98	unknown	United States	15169	GOOGLEUS	false
34.83.67.185	unknown	United States	15169	GOOGLEUS	false
34.34.145.103	unknown	United States	2686	ATGS-MMD-ASUS	true
34.169.99.17	unknown	United States	2686	ATGS-MMD-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580519
Start date and time:	2024-12-24 20:56:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gfehgfwveg.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@6/0@0/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: gfehgfwveg.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	https://issuu.com/txbct.com/docs/navex_quote_65169.?fr=xKAE9_zU1NQ	Get hash	malicious	HTMLPhisher	Browse	34.36.49.68
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	32.27.52.57
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	57.54.62.198
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	34.133.187.81
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	48.209.59.149
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	57.210.138.22
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	48.123.52.22
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	48.168.135.209
	armv7l.elf	Get hash	malicious	Mirai	Browse	34.17.113.87
ATGS-MMD-ASUS	https://issuu.com/txbct.com/docs/navex_quote_65169.?fr=xKAE9_zU1NQ	Get hash	malicious	HTMLPhisher	Browse	34.36.49.68
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	32.27.52.57
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	57.54.62.198
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	34.133.187.81
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	48.209.59.149
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	57.210.138.22
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	48.123.52.22
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	48.168.135.209
	armv7l.elf	Get hash	malicious	Mirai	Browse	34.17.113.87

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.797143844212164
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	gfehgfwveg.exe
File size:	4'276'224 bytes
MD5:	43ec2649e1b173b6e8b3800e18cceeb4
SHA1:	e864b2d11a7c9c7497b22af930b31db1e2061244
SHA256:	4e906e880e35e4bc0de7e9375fc0feb5757374ca0bb628dff6366174536d6183
SHA512:	83ec8f330986807a7b927c47f6becf26fd926bbfac096b9160c36e30c3a30fd7e05ebdef2556dc1aab3c61bf01e1f633ab6e9535440d95bdfcfa418bf139f086
SSDEEP:	98304:nNLjlVuxN0obg4MLp6bsYOYQyLmZwPoyAkDnZ:n5lVuxNvglisVyLZPJDnZ
TLSH:	9F16F122F64C667ED4AF0E395877B594583F77A1B99ADC1B47E0098CCE35880363A24F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x7eee00
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x676AEC85 [Tue Dec 24 17:16:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	29e05b1fea10173c5bcc5ba6150988ec

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFE4h
xor eax, eax
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-18h], eax
mov eax, 007E9C9Ch
call 00007F2C2822CD6Dh
xor eax, eax
push ebp
push 007EEF1Dh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
call 00007F2C286058AAh
cmp eax, 000000FAh
jnl 00007F2C2860B762h
call 00007F2C286058F6h
cmp eax, 78h
jnl 00007F2C2860B754h
mov dword ptr [007FCFA0h], 00000001h
mov dword ptr [007FCF9Ch], 001DBCD7h
mov eax, dword ptr [007FCF9Ch]
mov dword ptr [007FCFA4h], eax
mov eax, dword ptr [007FCF9Ch]
test eax, eax
jl 00007F2C2860B6BEh
inc eax
mov dword ptr [ebp-14h], eax
mov dword ptr [007FCF98h], 00000000h
inc dword ptr [007FCFA0h]
dec dword ptr [007FCFA4h]
push 00000000h
call 00007F2C28244D69h
inc dword ptr [007FCF98h]
dec dword ptr [ebp-14h]
jne 00007F2C2860B674h
cmp dword ptr [007FCFA4h], FFFFFFFFh
jne 00007F2C2860B6F4h
lea edx, dword ptr [ebp-18h]
mov ax, 0063h
call 00007F2C28605BD1h
mov eax, dword ptr [ebp-18h]
mov edx, 007EEF38h
call 00007F2C2822729Ch
je 00007F2C2860B6D9h
call 00007F2C28605E11h
cmp eax, 0Ah
jbe 00007F2C2860B6CFh
call 00007F2C28615E27h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x400000	0x96	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3fd000	0x16c6	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x41d000	0x3600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x403000	0x191c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x402000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3fd4cc	0x364	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3ff000	0x278	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ec544	0x3ec600	d7aefb5d6e6de984e994dc7c45754b87	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x3ee000	0xf50	0x1000	aada5a4a7410fe967643c3d004a17c32	False	0.558349609375	data	6.162614752272672	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3ef000	0x7d68	0x7e00	72410db874b473bfd55dbb3785831cd6	False	0.5638950892857143	data	6.356179507417859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x3f7000	0x5fac	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3fd000	0x16c6	0x1800	f83dfbc7a8d8169726b5b3aba8787951	False	0.3240559895833333	data	4.895786587173563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x3ff000	0x278	0x400	7a0cace727c21d6b42ac476919254aa3	False	0.26953125	firmware 100 v0 (revision 2733719296) X\361? , version 54304.16640.10270 (region 2297446144), 0 bytes or less, UNKNOWN1 0x88f03f00, at 0 0 bytes , at 0 0 bytes , at 0x60524000 3629203456 bytes	2.7239518130953684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x400000	0x96	0x200	09704f1006f905baccdf053cd9af9689	False	0.248046875	data	1.738190464085354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x401000	0x20	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x402000	0x5c	0x200	610e9cb9d596ddf3f8481c9e9885e5fe	False	0.1875	data	1.343433641850296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x403000	0x191c0	0x19200	2d0a440ed47b481783a33f1e4c0e5378	False	0.5856071206467661	data	6.706934385109459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x41d000	0x3600	0x3600	d77787dd189e78a674c960d21fa4face	False	0.2931857638888889	data	3.7312727777990213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_STRING	0x41d368	0x4e0	data	0.3333333333333333
RT_STRING	0x41d848	0x310	data	0.35331632653061223
RT_STRING	0x41db58	0x330	data	0.39215686274509803
RT_STRING	0x41de88	0x4c4	data	0.3983606557377049
RT_STRING	0x41e34c	0x4ac	data	0.32274247491638797
RT_STRING	0x41e7f8	0x3b4	data	0.3628691983122363
RT_STRING	0x41ebac	0x440	data	0.38235294117647056
RT_STRING	0x41efec	0x21c	data	0.40555555555555556
RT_STRING	0x41f208	0xbc	data	0.6542553191489362
RT_STRING	0x41f2c4	0x100	data	0.62890625
RT_STRING	0x41f3c4	0x338	data	0.4223300970873786
RT_STRING	0x41f6fc	0x478	data	0.29895104895104896
RT_STRING	0x41fb74	0x354	data	0.4107981220657277
RT_STRING	0x41fec8	0x2b8	data	0.4367816091954023
RT_RCDATA	0x420180	0x10	data	1.5
RT_RCDATA	0x420190	0x3ec	data	0.6125498007968128

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	CreateWindowExW, UpdateWindow, TranslateMessage, SystemParametersInfoW, ShowWindow, RegisterClassW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, GetMessageW, EndPaint, DispatchMessageW, DefWindowProcW, CharUpperBuffW, CharUpperW, CharLowerBuffW, BeginPaint
gdi32.dll	SetBkColor, Rectangle
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, UnmapViewOfFile, SwitchToThread, SuspendThread, Sleep, SetThreadPriority, SetLastError, SetFileTime, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReleaseSemaphore, ReadFile, RaiseException, QueryDosDeviceW, IsDebuggerPresent, MapViewOfFile, LocalFree, LoadLibraryA, LoadLibraryW, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVolumeInformationW, GetVersionExW, GetTimeZoneInformation, GetTickCount64, GetTickCount, GetThreadPriority, GetThreadLocale, GetSystemInfo, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLogicalDrives, GetLogicalDriveStringsW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesExW, GetFileAttributesW, GetExitCodeThread, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeLibrary, FormatMessageW, FlushInstructionCache, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitProcess, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateSemaphoreA, CreateProcessW, CreatePipe, CreateFileMappingW, CreateFileW, CreateEventA, CreateEventW, CreateDirectoryW, CompareStringW, CloseHandle
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
msvcrt.dll	memset, memmove, memcpy
msvcrt.dll	_beginthreadex
winmm.dll	waveOutGetVolume

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x7824b4
__dbk_fcall_wrapper	2	0x4103c4
dbkFCallWrapperAddr	1	0x7fa630

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T20:58:13.887150+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49830	34.34.145.103	443	TCP
2024-12-24T20:58:14.953488+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49831	34.169.99.17	443	TCP
2024-12-24T20:58:16.044840+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49835	34.83.67.185	443	TCP
2024-12-24T20:58:17.119157+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49838	35.195.45.98	443	TCP
2024-12-24T20:59:18.664291+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49981	34.34.145.103	443	TCP
2024-12-24T20:59:20.009982+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49985	34.169.99.17	443	TCP
2024-12-24T20:59:21.083789+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49988	34.83.67.185	443	TCP
2024-12-24T20:59:22.135469+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	49991	35.195.45.98	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 20:57:08.524483919 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:57:08.524509907 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:57:08.524571896 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:57:08.591147900 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:57:08.591160059 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:57:08.591238976 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:57:08.591245890 CET	49704	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:57:08.591264963 CET	443	49704	34.34.145.103	192.168.2.5
Dec 24, 2024 20:57:09.609468937 CET	49705	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:57:09.609519958 CET	443	49705	34.169.99.17	192.168.2.5
Dec 24, 2024 20:57:09.609601021 CET	49705	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:57:09.671768904 CET	49705	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:57:09.671787977 CET	443	49705	34.169.99.17	192.168.2.5
Dec 24, 2024 20:57:09.671844006 CET	443	49705	34.169.99.17	192.168.2.5
Dec 24, 2024 20:57:09.671849012 CET	49705	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:57:09.671858072 CET	443	49705	34.169.99.17	192.168.2.5
Dec 24, 2024 20:57:10.685132027 CET	49706	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:57:10.685167074 CET	443	49706	34.83.67.185	192.168.2.5
Dec 24, 2024 20:57:10.685261011 CET	49706	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:57:10.752799988 CET	49706	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:57:10.752824068 CET	443	49706	34.83.67.185	192.168.2.5
Dec 24, 2024 20:57:10.752871037 CET	49706	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:57:10.752876997 CET	443	49706	34.83.67.185	192.168.2.5
Dec 24, 2024 20:57:10.752924919 CET	443	49706	34.83.67.185	192.168.2.5
Dec 24, 2024 20:57:11.767685890 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:57:11.767725945 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:57:11.767807961 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:57:11.849766016 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:57:11.849787951 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:57:11.849853039 CET	49707	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:57:11.849859953 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:57:11.849894047 CET	443	49707	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:13.825732946 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:13.825747967 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:13.825817108 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:13.887150049 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:13.887166023 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:13.887217999 CET	49830	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:13.887223005 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:13.887274027 CET	443	49830	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:14.903908014 CET	49831	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:58:14.904010057 CET	443	49831	34.169.99.17	192.168.2.5
Dec 24, 2024 20:58:14.904104948 CET	49831	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:58:14.953488111 CET	49831	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:58:14.953528881 CET	443	49831	34.169.99.17	192.168.2.5
Dec 24, 2024 20:58:14.953632116 CET	443	49831	34.169.99.17	192.168.2.5
Dec 24, 2024 20:58:15.966931105 CET	49835	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:15.967015982 CET	443	49835	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:15.967107058 CET	49835	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:16.044840097 CET	49835	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:16.044878960 CET	443	49835	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:16.044960976 CET	49835	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:16.044972897 CET	443	49835	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:16.045011044 CET	443	49835	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:17.060699940 CET	49838	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.060801983 CET	443	49838	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:17.060910940 CET	49838	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.119157076 CET	49838	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.119189024 CET	443	49838	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:17.119256020 CET	49838	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.119261980 CET	443	49838	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:17.119304895 CET	443	49838	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:17.126014948 CET	49839	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:17.126044035 CET	443	49839	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:17.126133919 CET	49839	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:17.195209026 CET	49839	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:17.195223093 CET	443	49839	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:17.195280075 CET	49839	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:58:17.195283890 CET	443	49839	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:17.195362091 CET	443	49839	34.34.145.103	192.168.2.5
Dec 24, 2024 20:58:17.205153942 CET	49840	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:58:17.205177069 CET	443	49840	34.169.99.17	192.168.2.5
Dec 24, 2024 20:58:17.205307961 CET	49840	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:58:17.286787987 CET	49840	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:58:17.286798954 CET	443	49840	34.169.99.17	192.168.2.5
Dec 24, 2024 20:58:17.286865950 CET	49840	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:58:17.286870956 CET	443	49840	34.169.99.17	192.168.2.5
Dec 24, 2024 20:58:17.287019968 CET	443	49840	34.169.99.17	192.168.2.5
Dec 24, 2024 20:58:17.295407057 CET	49841	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:17.295507908 CET	443	49841	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:17.295614958 CET	49841	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:17.402021885 CET	49841	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:17.402095079 CET	443	49841	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:17.402153015 CET	443	49841	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:17.402184963 CET	49841	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:58:17.402259111 CET	443	49841	34.83.67.185	192.168.2.5
Dec 24, 2024 20:58:17.411962032 CET	49843	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.412045956 CET	443	49843	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:17.412153006 CET	49843	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.476381063 CET	49843	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.476433992 CET	443	49843	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:17.476486921 CET	443	49843	35.195.45.98	192.168.2.5
Dec 24, 2024 20:58:17.476515055 CET	49843	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:58:17.476553917 CET	443	49843	35.195.45.98	192.168.2.5
Dec 24, 2024 20:59:18.607034922 CET	49981	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:59:18.607055902 CET	443	49981	34.34.145.103	192.168.2.5
Dec 24, 2024 20:59:18.607127905 CET	49981	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:59:18.664290905 CET	49981	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:59:18.664305925 CET	443	49981	34.34.145.103	192.168.2.5
Dec 24, 2024 20:59:18.664355993 CET	49981	443	192.168.2.5	34.34.145.103
Dec 24, 2024 20:59:18.664396048 CET	443	49981	34.34.145.103	192.168.2.5
Dec 24, 2024 20:59:18.664480925 CET	443	49981	34.34.145.103	192.168.2.5
Dec 24, 2024 20:59:19.927069902 CET	49985	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:59:19.927100897 CET	443	49985	34.169.99.17	192.168.2.5
Dec 24, 2024 20:59:19.927150011 CET	49985	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:59:20.009982109 CET	49985	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:59:20.009995937 CET	443	49985	34.169.99.17	192.168.2.5
Dec 24, 2024 20:59:20.010052919 CET	49985	443	192.168.2.5	34.169.99.17
Dec 24, 2024 20:59:20.010062933 CET	443	49985	34.169.99.17	192.168.2.5
Dec 24, 2024 20:59:20.010066986 CET	443	49985	34.169.99.17	192.168.2.5
Dec 24, 2024 20:59:21.029668093 CET	49988	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:59:21.029717922 CET	443	49988	34.83.67.185	192.168.2.5
Dec 24, 2024 20:59:21.029848099 CET	49988	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:59:21.083789110 CET	49988	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:59:21.083818913 CET	443	49988	34.83.67.185	192.168.2.5
Dec 24, 2024 20:59:21.083883047 CET	49988	443	192.168.2.5	34.83.67.185
Dec 24, 2024 20:59:21.083923101 CET	443	49988	34.83.67.185	192.168.2.5
Dec 24, 2024 20:59:22.091464996 CET	49991	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:59:22.091528893 CET	443	49991	35.195.45.98	192.168.2.5
Dec 24, 2024 20:59:22.091618061 CET	49991	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:59:22.135468960 CET	49991	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:59:22.135502100 CET	443	49991	35.195.45.98	192.168.2.5
Dec 24, 2024 20:59:22.135580063 CET	49991	443	192.168.2.5	35.195.45.98
Dec 24, 2024 20:59:22.135622978 CET	443	49991	35.195.45.98	192.168.2.5

Target ID:	0
Start time:	14:57:01
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\gfehgfwveg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gfehgfwveg.exe"
Imagebase:	0x400000
File size:	4'276'224 bytes
MD5 hash:	43EC2649E1B173B6E8B3800E18CCEEB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	14:57:04
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:57:04
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	14:57:04
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Imagebase:	0x2c0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true