Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
EZ9o9I0iW9.exe

Overview

General Information

Sample name:EZ9o9I0iW9.exe
renamed because original name is a hash value
Original sample name:dbb22674909ea61a10c6ac57188d8e1c5be5f9c45dde9068d88bff3b8cf8fa71.exe
Analysis ID:1588180
MD5:b65b1373d121434393fb08d91d964eaf
SHA1:ee545aaf0ad4090256d35b57104d9475e0d7ed28
SHA256:dbb22674909ea61a10c6ac57188d8e1c5be5f9c45dde9068d88bff3b8cf8fa71
Tags:exeuser-adrian__luca
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

  • System is w10x64
  • EZ9o9I0iW9.exe (PID: 4784 cmdline: "C:\Users\user\Desktop\EZ9o9I0iW9.exe" MD5: B65B1373D121434393FB08D91D964EAF)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: EZ9o9I0iW9.exeVirustotal: Detection: 36%Perma Link
Source: EZ9o9I0iW9.exeReversingLabs: Detection: 73%
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Source: EZ9o9I0iW9.exeJoe Sandbox ML: detected
Source: EZ9o9I0iW9.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: EZ9o9I0iW9.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: Joe Sandbox ViewIP Address: 45.9.191.182 45.9.191.182
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /book/Fvrbzpfzrm.vdf HTTP/1.1Host: xianggrhen.comConnection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: xianggrhen.com
Source: EZ9o9I0iW9.exe, 00000000.00000002.3113995543.000000000319A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, EZ9o9I0iW9.exe, 00000000.00000002.3113995543.000000000319A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://xianggrhen.com
Source: EZ9o9I0iW9.exe, 00000000.00000002.3113995543.0000000003131000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://xianggrhen.com/book/Fvrbzpfzrm.vdf
Source: EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://xianggrhen.com/book/Fvrbzpfzrm.vdfHK
Source: EZ9o9I0iW9.exeString found in binary or memory: http://xianggrhen.com/book/Fvrbzpfzrm.vdfKBICejy0xrNPVRNUgGT.WngTVxKdMdCij0csUU
Source: EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://xianggrhen.com/book/Fvrbzpfzrm.vdfd
Source: EZ9o9I0iW9.exe, 00000000.00000002.3113995543.0000000003131000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://xianggrhen.com/book/Fvrbzpfzrm.vdfto
Source: EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://xianggrhen.comd
Source: EZ9o9I0iW9.exeStatic PE information: invalid certificate
Source: EZ9o9I0iW9.exe, 00000000.00000000.1249880018.0000000000E74000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameZkdeisza.exe vs EZ9o9I0iW9.exe
Source: EZ9o9I0iW9.exe, 00000000.00000002.3112910480.00000000013BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs EZ9o9I0iW9.exe
Source: EZ9o9I0iW9.exeBinary or memory string: OriginalFilenameZkdeisza.exe vs EZ9o9I0iW9.exe
Source: EZ9o9I0iW9.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: mal56.winEXE@1/0@1/1
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeMutant created: NULL
Source: EZ9o9I0iW9.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: EZ9o9I0iW9.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: EZ9o9I0iW9.exeVirustotal: Detection: 36%
Source: EZ9o9I0iW9.exeReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: rasman.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeSection loaded: fwpuclnt.dllJump to behavior
Source: EZ9o9I0iW9.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: EZ9o9I0iW9.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeMemory allocated: 16D0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeMemory allocated: 3130000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeMemory allocated: 5130000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeThread delayed: delay time: 600000Jump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exe TID: 7636Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exe TID: 7636Thread sleep time: -600000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeThread delayed: delay time: 600000Jump to behavior
Source: EZ9o9I0iW9.exe, 00000000.00000002.3112910480.0000000001411000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeMemory allocated: page read and write | page guardJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeQueries volume information: C:\Users\user\Desktop\EZ9o9I0iW9.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\EZ9o9I0iW9.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading
1
DLL Side-Loading
1
Disable or Modify Tools
OS Credential Dumping1
Security Software Discovery
Remote ServicesData from Local System2
Non-Application Layer Protocol
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts31
Virtualization/Sandbox Evasion
LSASS Memory31
Virtualization/Sandbox Evasion
Remote Desktop ProtocolData from Removable Media2
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading
Security Account Manager12
System Information Discovery
SMB/Windows Admin SharesData from Network Shared Drive1
Ingress Tool Transfer
Automated ExfiltrationData Encrypted for Impact
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
EZ9o9I0iW9.exe36%VirustotalBrowse
EZ9o9I0iW9.exe74%ReversingLabsWin32.Trojan.Jalapeno
EZ9o9I0iW9.exe100%Joe Sandbox ML
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://xianggrhen.com0%Avira URL Cloudsafe
http://xianggrhen.com/book/Fvrbzpfzrm.vdf0%Avira URL Cloudsafe
http://xianggrhen.com/book/Fvrbzpfzrm.vdfto0%Avira URL Cloudsafe
http://xianggrhen.comd0%Avira URL Cloudsafe
http://xianggrhen.com/book/Fvrbzpfzrm.vdfHK0%Avira URL Cloudsafe
http://xianggrhen.com/book/Fvrbzpfzrm.vdfKBICejy0xrNPVRNUgGT.WngTVxKdMdCij0csUU0%Avira URL Cloudsafe
http://xianggrhen.com/book/Fvrbzpfzrm.vdfd0%Avira URL Cloudsafe
NameIPActiveMaliciousAntivirus DetectionReputation
xianggrhen.com
45.9.191.182
truefalse
    unknown
    NameMaliciousAntivirus DetectionReputation
    http://xianggrhen.com/book/Fvrbzpfzrm.vdffalse
    • Avira URL Cloud: safe
    unknown
    NameSourceMaliciousAntivirus DetectionReputation
    http://xianggrhen.comEZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, EZ9o9I0iW9.exe, 00000000.00000002.3113995543.000000000319A000.00000004.00000800.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://xianggrhen.com/book/Fvrbzpfzrm.vdftoEZ9o9I0iW9.exe, 00000000.00000002.3113995543.0000000003131000.00000004.00000800.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://xianggrhen.com/book/Fvrbzpfzrm.vdfKBICejy0xrNPVRNUgGT.WngTVxKdMdCij0csUUEZ9o9I0iW9.exefalse
    • Avira URL Cloud: safe
    unknown
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameEZ9o9I0iW9.exe, 00000000.00000002.3113995543.000000000319A000.00000004.00000800.00020000.00000000.sdmpfalse
      high
      http://xianggrhen.comdEZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, EZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      unknown
      http://xianggrhen.com/book/Fvrbzpfzrm.vdfHKEZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      unknown
      http://xianggrhen.com/book/Fvrbzpfzrm.vdfdEZ9o9I0iW9.exe, 00000000.00000002.3113995543.00000000031C4000.00000004.00000800.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      unknown
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      45.9.191.182
      xianggrhen.comGermany
      47583AS-HOSTINGERLTfalse
      Joe Sandbox version:42.0.0 Malachite
      Analysis ID:1588180
      Start date and time:2025-01-10 22:26:42 +01:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 5m 1s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Run name:Run with higher sleep bypass
      Number of analysed new started processes analysed:13
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:EZ9o9I0iW9.exe
      renamed because original name is a hash value
      Original Sample Name:dbb22674909ea61a10c6ac57188d8e1c5be5f9c45dde9068d88bff3b8cf8fa71.exe
      Detection:MAL
      Classification:mal56.winEXE@1/0@1/1
      EGA Information:Failed
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 6
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Found application associated with file extension: .exe
      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
      • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
      • Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
      • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, oneocsp.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
      • Execution Graph export aborted for target EZ9o9I0iW9.exe, PID 4784 because it is empty
      • Not all processes where analyzed, report is missing behavior information
      • Report size getting too big, too many NtQueryValueKey calls found.
      • Report size getting too big, too many NtReadVirtualMemory calls found.
      No simulations
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      45.9.191.182rDecPayment_Swi.exeGet hashmaliciousUnknownBrowse
      • xianggrhen.com/book/Netnoyfq.mp3
      10thDecember2024SWIFT-40111-34000-5410-24532-10477-65011-239605.exeGet hashmaliciousUnknownBrowse
      • xianggrhen.com/composure/Emmaj.vdf
      LE-Y5029-D3948-W3029-K4302-Q20930-R4039-Y4938-E3028-LA3829-D300.exeGet hashmaliciousUnknownBrowse
      • xianggrhen.com/composure/Vuglyxyuvio.pdf
      MN-PAYMENT20241206-5002-10259-410291-30198-281920-30183-21474.exeGet hashmaliciousUnknownBrowse
      • xianggrhen.com/camp/Reibbfkkyy.dat
      DecPayment410_F2103_S29103_M839_U4721_S381I_S98EEU_USD031224.exeGet hashmaliciousUnknownBrowse
      • xianggrhen.com/desk/Tbddfcris.vdf
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      xianggrhen.comrDecPayment_Swi.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      10thDecember2024SWIFT-40111-34000-5410-24532-10477-65011-239605.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      LE-Y5029-D3948-W3029-K4302-Q20930-R4039-Y4938-E3028-LA3829-D300.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      MN-PAYMENT20241206-5002-10259-410291-30198-281920-30183-21474.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      DecPayment410_F2103_S29103_M839_U4721_S381I_S98EEU_USD031224.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      AMTR-TT4781-SWFT-U4Y81-SO39-C37AR-AO937-CNR742-S3782-2818DY-9A82.exeGet hashmaliciousUnknownBrowse
      • 92.113.29.113
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      AS-HOSTINGERLTEmployee_Letter.pdfGet hashmaliciousHTMLPhisherBrowse
      • 92.249.45.121
      rDecPayment_Swi.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      10thDecember2024SWIFT-40111-34000-5410-24532-10477-65011-239605.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      LE-Y5029-D3948-W3029-K4302-Q20930-R4039-Y4938-E3028-LA3829-D300.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      Employee_Letter.pdfGet hashmaliciousHTMLPhisherBrowse
      • 92.249.45.121
      MN-PAYMENT20241206-5002-10259-410291-30198-281920-30183-21474.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      DecPayment410_F2103_S29103_M839_U4721_S381I_S98EEU_USD031224.exeGet hashmaliciousUnknownBrowse
      • 45.9.191.182
      https://application-workspace.com/red-bull/id-38772Get hashmaliciousUnknownBrowse
      • 45.84.207.234
      https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.orgGet hashmaliciousUnknownBrowse
      • 31.170.162.164
      No context
      No context
      No created / dropped files found
      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
      Entropy (8bit):4.939291175849229
      TrID:
      • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
      • Win32 Executable (generic) a (10002005/4) 49.97%
      • Generic Win/DOS Executable (2004/3) 0.01%
      • DOS Executable Generic (2002/1) 0.01%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:EZ9o9I0iW9.exe
      File size:203'112 bytes
      MD5:b65b1373d121434393fb08d91d964eaf
      SHA1:ee545aaf0ad4090256d35b57104d9475e0d7ed28
      SHA256:dbb22674909ea61a10c6ac57188d8e1c5be5f9c45dde9068d88bff3b8cf8fa71
      SHA512:1b608fbbc9f1f1acccad1fbd332440faa869d2826c2b238d8d8695a418d31c339b4b6384053696ae409a6af8244516341a01ca75cc3b055357df10f27f83f599
      SSDEEP:3072:Mbssssssswsssssssssss9ssssssssssGX8ssssssssssssssssslsssssssssso:Mdy
      TLSH:3914B23A32F08556CD298033B492C57D55E4AEEDEC81929BF3E86EDA78432D1434E58F
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O.Yg.............................,... ...@....@.. .......................@............`................................
      Icon Hash:74f2dacecacede42
      Entrypoint:0x402c9e
      Entrypoint Section:.text
      Digitally signed:true
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Time Stamp:0x67591F4F [Wed Dec 11 05:12:47 2024 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744
      Signature Valid:false
      Signature Issuer:CN=Microsoft ID Verified CS EOC CA 01, O=Microsoft Corporation, C=US
      Signature Validation Error:The digital signature of the object did not verify
      Error Number:-2146869232
      Not Before, Not After
      • 10/12/2024 02:17:11 13/12/2024 02:17:11
      Subject Chain
      • CN=BURNAWARE SL, O=BURNAWARE SL, L=MARBELLA, S=M\xe1laga, C=ES
      Version:3
      Thumbprint MD5:BFFBA655F566ADA00BFB879A629E693A
      Thumbprint SHA-1:89C2350B8D324ECDE615A61F9429F9AC9673D378
      Thumbprint SHA-256:EF9A295E1713BD0770A542692D81388BE8C1EBCAC6FA06899781943C8089CBB9
      Serial:33000147C8435BBC2DF65BAE5E0000000147C8
      Instruction
      jmp dword ptr [00402000h]
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x2c500x4b.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x40000x2c936.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x2dc000x3d68
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x320000xc.reloc
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x20000xca40xe0030922bbeed4c6d4a7e0963d24b35d2c1False0.5125558035714286data5.015629625093002IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      .rsrc0x40000x2c9360x2ca0089e8d4589a55da5eebbd553bafbc55d8False0.255640537464986data4.53358919115677IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .reloc0x320000xc0x200b6da7f2a77681d781cafa4b9ea483f19False0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      NameRVASizeTypeLanguageCountryZLIB Complexity
      RT_ICON0x42b00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 14172 x 14172 px/m0.6897163120567376
      RT_ICON0x47180x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 14172 x 14172 px/m0.4799180327868853
      RT_ICON0x50a00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 14172 x 14172 px/m0.35881801125703566
      RT_ICON0x61480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 14172 x 14172 px/m0.2649377593360996
      RT_ICON0x86f00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 14172 x 14172 px/m0.2106164383561644
      RT_ICON0xc9180x5488Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 14172 x 14172 px/m0.1911275415896488
      RT_ICON0x11da00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 14172 x 14172 px/m0.15043619928526383
      RT_ICON0x1b2480x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 14172 x 14172 px/m0.12436413107772389
      RT_ICON0x2ba700x46c7PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9989513770075611
      RT_GROUP_ICON0x301380x84data0.7272727272727273
      RT_VERSION0x301bc0x58edata0.2918424753867792
      RT_MANIFEST0x3074c0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347
      DLLImport
      mscoree.dll_CorExeMain
      TimestampSource PortDest PortSource IPDest IP
      Jan 10, 2025 22:27:37.227781057 CET4970380192.168.2.745.9.191.182
      Jan 10, 2025 22:27:37.232604027 CET804970345.9.191.182192.168.2.7
      Jan 10, 2025 22:27:37.235017061 CET4970380192.168.2.745.9.191.182
      Jan 10, 2025 22:27:37.237380981 CET4970380192.168.2.745.9.191.182
      Jan 10, 2025 22:27:37.242156029 CET804970345.9.191.182192.168.2.7
      Jan 10, 2025 22:27:58.614065886 CET804970345.9.191.182192.168.2.7
      Jan 10, 2025 22:27:58.614257097 CET4970380192.168.2.745.9.191.182
      Jan 10, 2025 22:27:58.626195908 CET4970380192.168.2.745.9.191.182
      Jan 10, 2025 22:27:58.630942106 CET804970345.9.191.182192.168.2.7
      Jan 10, 2025 22:27:58.631972075 CET4978580192.168.2.745.9.191.182
      Jan 10, 2025 22:27:58.636775017 CET804978545.9.191.182192.168.2.7
      Jan 10, 2025 22:27:58.636948109 CET4978580192.168.2.745.9.191.182
      Jan 10, 2025 22:27:58.637126923 CET4978580192.168.2.745.9.191.182
      Jan 10, 2025 22:27:58.641918898 CET804978545.9.191.182192.168.2.7
      Jan 10, 2025 22:28:20.024014950 CET804978545.9.191.182192.168.2.7
      Jan 10, 2025 22:28:20.024091959 CET4978580192.168.2.745.9.191.182
      Jan 10, 2025 22:28:20.025481939 CET4978580192.168.2.745.9.191.182
      Jan 10, 2025 22:28:20.030263901 CET804978545.9.191.182192.168.2.7
      Jan 10, 2025 22:28:20.055742979 CET4991780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:20.060700893 CET804991745.9.191.182192.168.2.7
      Jan 10, 2025 22:28:20.060789108 CET4991780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:20.063113928 CET4991780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:20.067917109 CET804991745.9.191.182192.168.2.7
      Jan 10, 2025 22:28:41.431771040 CET804991745.9.191.182192.168.2.7
      Jan 10, 2025 22:28:41.431951046 CET4991780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:41.432094097 CET4991780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:41.432570934 CET4997780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:41.437796116 CET804991745.9.191.182192.168.2.7
      Jan 10, 2025 22:28:41.438652039 CET804997745.9.191.182192.168.2.7
      Jan 10, 2025 22:28:41.438775063 CET4997780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:41.438858986 CET4997780192.168.2.745.9.191.182
      Jan 10, 2025 22:28:41.444886923 CET804997745.9.191.182192.168.2.7
      Jan 10, 2025 22:29:02.803935051 CET804997745.9.191.182192.168.2.7
      Jan 10, 2025 22:29:02.804084063 CET4997780192.168.2.745.9.191.182
      Jan 10, 2025 22:29:02.804197073 CET4997780192.168.2.745.9.191.182
      Jan 10, 2025 22:29:02.804857969 CET4997980192.168.2.745.9.191.182
      Jan 10, 2025 22:29:02.809036970 CET804997745.9.191.182192.168.2.7
      Jan 10, 2025 22:29:02.809729099 CET804997945.9.191.182192.168.2.7
      Jan 10, 2025 22:29:02.809806108 CET4997980192.168.2.745.9.191.182
      Jan 10, 2025 22:29:02.809922934 CET4997980192.168.2.745.9.191.182
      Jan 10, 2025 22:29:02.814769983 CET804997945.9.191.182192.168.2.7
      Jan 10, 2025 22:29:24.177650928 CET804997945.9.191.182192.168.2.7
      Jan 10, 2025 22:29:24.177870989 CET4997980192.168.2.745.9.191.182
      Jan 10, 2025 22:29:24.177915096 CET4997980192.168.2.745.9.191.182
      Jan 10, 2025 22:29:24.178333998 CET4998080192.168.2.745.9.191.182
      Jan 10, 2025 22:29:24.182733059 CET804997945.9.191.182192.168.2.7
      Jan 10, 2025 22:29:24.183212996 CET804998045.9.191.182192.168.2.7
      Jan 10, 2025 22:29:24.183310986 CET4998080192.168.2.745.9.191.182
      Jan 10, 2025 22:29:24.183487892 CET4998080192.168.2.745.9.191.182
      Jan 10, 2025 22:29:24.188257933 CET804998045.9.191.182192.168.2.7
      Jan 10, 2025 22:29:45.568404913 CET804998045.9.191.182192.168.2.7
      Jan 10, 2025 22:29:45.568587065 CET4998080192.168.2.745.9.191.182
      Jan 10, 2025 22:29:45.568924904 CET4998080192.168.2.745.9.191.182
      Jan 10, 2025 22:29:45.571222067 CET4998180192.168.2.745.9.191.182
      Jan 10, 2025 22:29:45.573694944 CET804998045.9.191.182192.168.2.7
      Jan 10, 2025 22:29:45.576088905 CET804998145.9.191.182192.168.2.7
      Jan 10, 2025 22:29:45.576467037 CET4998180192.168.2.745.9.191.182
      Jan 10, 2025 22:29:45.576951981 CET4998180192.168.2.745.9.191.182
      Jan 10, 2025 22:29:45.581705093 CET804998145.9.191.182192.168.2.7
      Jan 10, 2025 22:30:06.943826914 CET804998145.9.191.182192.168.2.7
      Jan 10, 2025 22:30:06.943945885 CET4998180192.168.2.745.9.191.182
      Jan 10, 2025 22:30:06.944052935 CET4998180192.168.2.745.9.191.182
      Jan 10, 2025 22:30:06.944508076 CET4998280192.168.2.745.9.191.182
      Jan 10, 2025 22:30:06.948800087 CET804998145.9.191.182192.168.2.7
      Jan 10, 2025 22:30:06.949394941 CET804998245.9.191.182192.168.2.7
      Jan 10, 2025 22:30:06.949563980 CET4998280192.168.2.745.9.191.182
      Jan 10, 2025 22:30:06.949599028 CET4998280192.168.2.745.9.191.182
      Jan 10, 2025 22:30:06.954473972 CET804998245.9.191.182192.168.2.7
      Jan 10, 2025 22:30:28.353903055 CET804998245.9.191.182192.168.2.7
      Jan 10, 2025 22:30:28.354057074 CET4998280192.168.2.745.9.191.182
      Jan 10, 2025 22:30:28.354202032 CET4998280192.168.2.745.9.191.182
      Jan 10, 2025 22:30:28.354895115 CET4998380192.168.2.745.9.191.182
      Jan 10, 2025 22:30:28.358957052 CET804998245.9.191.182192.168.2.7
      Jan 10, 2025 22:30:28.359704971 CET804998345.9.191.182192.168.2.7
      Jan 10, 2025 22:30:28.359817982 CET4998380192.168.2.745.9.191.182
      Jan 10, 2025 22:30:28.359925985 CET4998380192.168.2.745.9.191.182
      Jan 10, 2025 22:30:28.364698887 CET804998345.9.191.182192.168.2.7
      TimestampSource PortDest PortSource IPDest IP
      Jan 10, 2025 22:27:37.206871986 CET6141453192.168.2.71.1.1.1
      Jan 10, 2025 22:27:37.221630096 CET53614141.1.1.1192.168.2.7
      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
      Jan 10, 2025 22:27:37.206871986 CET192.168.2.71.1.1.10x55cdStandard query (0)xianggrhen.comA (IP address)IN (0x0001)false
      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
      Jan 10, 2025 22:27:37.221630096 CET1.1.1.1192.168.2.70x55cdNo error (0)xianggrhen.com45.9.191.182A (IP address)IN (0x0001)false
      • xianggrhen.com
      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      0192.168.2.74970345.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:27:37.237380981 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      1192.168.2.74978545.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:27:58.637126923 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      2192.168.2.74991745.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:28:20.063113928 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      3192.168.2.74997745.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:28:41.438858986 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      4192.168.2.74997945.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:29:02.809922934 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      5192.168.2.74998045.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:29:24.183487892 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      6192.168.2.74998145.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:29:45.576951981 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      7192.168.2.74998245.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:30:06.949599028 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
      8192.168.2.74998345.9.191.182804784C:\Users\user\Desktop\EZ9o9I0iW9.exe
      TimestampBytes transferredDirectionData
      Jan 10, 2025 22:30:28.359925985 CET83OUTGET /book/Fvrbzpfzrm.vdf HTTP/1.1
      Host: xianggrhen.com
      Connection: Keep-Alive


      Click to jump to process

      Click to jump to process

      Click to dive into process behavior distribution

      Target ID:0
      Start time:16:27:36
      Start date:10/01/2025
      Path:C:\Users\user\Desktop\EZ9o9I0iW9.exe
      Wow64 process (32bit):true
      Commandline:"C:\Users\user\Desktop\EZ9o9I0iW9.exe"
      Imagebase:0xe70000
      File size:203'112 bytes
      MD5 hash:B65B1373D121434393FB08D91D964EAF
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:low
      Has exited:false

      Reset < >
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.3113807851.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_16d0000_EZ9o9I0iW9.jbxd
        Similarity
        • API ID:
        • String ID: toq
        • API String ID: 0-207910900
        • Opcode ID: cf2793c3929f08b010afc56f37df285880ba52135d3db98b7de58e549a0ebf6b
        • Instruction ID: bcba67ba40b11799321269dc6ade5be0e039959cec2c0215c6201ded0693209a
        • Opcode Fuzzy Hash: cf2793c3929f08b010afc56f37df285880ba52135d3db98b7de58e549a0ebf6b
        • Instruction Fuzzy Hash: ED217C74A00104CFDB04DF79D954BAD7FF2AF8C200F244469E442AB360CB359C42CB95
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.3113807851.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_16d0000_EZ9o9I0iW9.jbxd
        Similarity
        • API ID:
        • String ID: toq
        • API String ID: 0-207910900
        • Opcode ID: f6b7f2fe8af1c1079e11abde5d12fa286a2c5b4516ca4ebb3c85bb3add4f11f5
        • Instruction ID: f0d02554bdc823be2518c77fce15af7d04ab49e22077b25f3a6384f08e253b66
        • Opcode Fuzzy Hash: f6b7f2fe8af1c1079e11abde5d12fa286a2c5b4516ca4ebb3c85bb3add4f11f5
        • Instruction Fuzzy Hash: 01214974A00114CFDB08DF69D958BAE7BF2BF8C310F248469E406AB3A0DB359C41CBA5
        Memory Dump Source
        • Source File: 00000000.00000002.3113807851.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_16d0000_EZ9o9I0iW9.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a48e8906ed5432f7f0cbf254f2ef4dd21c9a4a8e16986747eb88d82544fd3f98
        • Instruction ID: 99266722b29bb401c25a7a1855f71e372d7f8156ce0d0d5e0cef16e8ca2f5925
        • Opcode Fuzzy Hash: a48e8906ed5432f7f0cbf254f2ef4dd21c9a4a8e16986747eb88d82544fd3f98
        • Instruction Fuzzy Hash: 44F0C2357043148FC714DB79E844AA93BF1FF89724B1500E9E504CB3A2CA75CC018792
        Memory Dump Source
        • Source File: 00000000.00000002.3113807851.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_16d0000_EZ9o9I0iW9.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 85eba8aa5f9d831d4d47a17b73636c30b34622fe365a133ffc42e9f095bd4ebf
        • Instruction ID: aebc4af34ce7b05e2c881422c9045d06f1de19bce8cfb46e5944f9080af37f22
        • Opcode Fuzzy Hash: 85eba8aa5f9d831d4d47a17b73636c30b34622fe365a133ffc42e9f095bd4ebf
        • Instruction Fuzzy Hash: 12F08C357002109FC718DB3EE848F6A3BEAEBCD761B2500A4E509CB3A4DE61DC0187A2
        Memory Dump Source
        • Source File: 00000000.00000002.3113807851.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_16d0000_EZ9o9I0iW9.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b6af6d1d2dd2b9a04517eeeb8a2f01a8dae04af4155718c8613d8bd8c4dfed47
        • Instruction ID: e9f3b4d655ff50487889fe181572d3d9e31e504cfd7ec7efa9d8b14a1e1972f1
        • Opcode Fuzzy Hash: b6af6d1d2dd2b9a04517eeeb8a2f01a8dae04af4155718c8613d8bd8c4dfed47
        • Instruction Fuzzy Hash: B7D05E356452949FC7019BB8E8188853BAAAF4B368B8901E6F189CB325DA659C01CB91
        Memory Dump Source
        • Source File: 00000000.00000002.3113807851.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_0_2_16d0000_EZ9o9I0iW9.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d0b0d46911abb46b705c119fb32a7766ce3b12ca6b46e01d5b98a523c8190e9c
        • Instruction ID: 417420570ea88c999f24d3257ae84b73477f1a1b72d67af9ee1a2e7262adb56f
        • Opcode Fuzzy Hash: d0b0d46911abb46b705c119fb32a7766ce3b12ca6b46e01d5b98a523c8190e9c
        • Instruction Fuzzy Hash: B0D0CA394442818FCB068F24DA141803BB2FE8B31438A40EAC2819B2A2E6382C82CB52