Edit tour

Windows Analysis Report
1https.exe

Overview

General Information

Sample name:	1https.exe
Analysis ID:	1645365
MD5:	3f6dd6c85f9e9a02fdea20076f69b66d
SHA1:	378b9c81eaa3cb51179a436ecb293d4da46fb66a
SHA256:	89b49994b3ab46875d0128673c87f15854bee5aff7ed13a812035c91a988636c
Infos:

Detection

Sliver

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Sliver Implants

Creates a process in suspended mode (likely to inject code)

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Yara signature match

Classification

Process Tree

System is w10x64_ra

1https.exe (PID: 3644 cmdline: "C:\Users\user\Desktop\1https.exe" MD5: 3F6DD6C85F9E9A02FDEA20076F69B66D)

rundll32.exe (PID: 1312 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 1968 cmdline: "C:\Windows\system32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

1https.exe (PID: 4152 cmdline: 1https.exe MD5: 3F6DD6C85F9E9A02FDEA20076F69B66D)

1https.exe (PID: 3540 cmdline: 1https.exe /? MD5: 3F6DD6C85F9E9A02FDEA20076F69B66D)

1https.exe (PID: 5280 cmdline: 1https.exe -? MD5: 3F6DD6C85F9E9A02FDEA20076F69B66D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Sliver	According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army.	No Attribution	https://asec.ahnlab.com/en/47088/ https://asec.ahnlab.com/en/55652/ https://asec.ahnlab.com/en/56941/ https://blog.cluster25.duskrise.com/2024/01/30/russian-apt-opposition https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1https.exe	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
1https.exe	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0xcf923f:$a1: ).RequestResend 0xce83a8:$a2: ).GetPrivInfo
1https.exe	INDICATOR_TOOL_Sliver	Detects Sliver implant cross-platform adversary emulation/red team	ditekSHen	0xa2bbb3:$s3: .WGTCPForwarder 0xa2c86c:$s3: .WGTCPForwarder 0xa2d825:$s3: .WGTCPForwarder 0xa2e8d1:$s3: .WGTCPForwarder 0xa3030d:$s3: .WGTCPForwarder 0xa310f7:$s3: .WGTCPForwarder 0xa293e7:$s6: .BackdoorReq 0xa2baff:$s7: .ProcessDumpReq 0xa2df5a:$s8: .InvokeSpawnDllReq 0xa257a1:$s9: .SpawnDll 0xa29546:$s9: .SpawnDll

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.2481682720.000000C00016C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000010.00000002.2484061604.000000C00024C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000010.00000002.2484061604.000000C000225000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000012.00000002.2481242678.000000C00013A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000012.00000002.2481242678.000000C00023E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000012.00000002.2481242678.000000C000168000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000000.00000002.2481363679.000000C00016A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x8663f:$a1: ).RequestResend 0x757a8:$a2: ).GetPrivInfo
00000000.00000000.1230899221.00000000017D7000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Process Memory Space: 1https.exe PID: 3644	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Process Memory Space: 1https.exe PID: 3644	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x62c58:$a1: ).RequestResend 0x73b04:$a1: ).RequestResend 0x27552:$a2: ).GetPrivInfo 0x522cc:$a2: ).GetPrivInfo
Process Memory Space: 1https.exe PID: 4152	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Process Memory Space: 1https.exe PID: 3540	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Process Memory Space: 1https.exe PID: 5280	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Click to see the 10 entries

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1https.exe	Virustotal: Detection: 72%			Perma Link
Source: 1https.exe	ReversingLabs: Detection: 64%

Source: 1https.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: marnyonline.com

Source: 1https.exe, 00000000.00000002.2480038503.000000C000072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cv=65202q943&h=HTTP/1.1
Source: 1https.exe, 00000010.00000002.2480062469.000000C000086000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gt=z2744p8252&j=HTTP/1.1
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i_=77g17927z1&t=HTTP/1.1
Source: 1https.exe, 00000011.00000002.2483693954.000000C000336000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://k=256l71421&ss=HTTP/1.1
Source: 1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2487235473.000001134EE6C000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2488818852.000001E39FC97000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2485093578.000001E21BBF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com
Source: 1https.exe, 00000000.00000003.2165989054.000001134EEA3000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2486341146.0000022B13087000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2485093578.000001E21BBF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/
Source: 1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html
Source: 1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?
Source: 1https.exe, 00000011.00000002.2483693954.000000C00037C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?k=256l71421&ss=7i7179u27
Source: 1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?n
Source: 1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.php
Source: 1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.phphttp://marnyonline.com/api
Source: 1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html
Source: 1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html?
Source: 1https.exe, 00000000.00000002.2481363679.000000C000132000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html?ab=7717c9271&m=764
Source: 1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.htmlhttp://marnyonline.
Source: 1https.exe, 00000000.00000002.2480038503.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.php
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/http://marnyonli
Source: 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/http://marnyonline.commarnyonline.com:80
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/http://marnyonline.commarnyonline.com:80sWGetExtendedUdpTableCreateToolhelp32
Source: 1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/http://marnyonline.commarnyonline.com:80tcpmarnyonline.comhttp://marnyonline.
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/namespaces/database/samples.html
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/namespaces/database/samples.html?
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/namespaces/database/samples.html?Mozilla/5.0
Source: 1https.exe, 00000012.00000002.2480038517.000000C000072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/namespaces/database/samples.html?i_=77g17927z1&t=842374m83
Source: 1https.exe, 00000012.00000002.2480038517.000000C000072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/namespaces/database/samples.html?i_=77g17927z1&t=842374m83Mozilla/5.0
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/namespaces/database/samples.php
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/namespaces/database/samples.phphttp://marnyonline.com/namespaces/database/sam
Source: 1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html
Source: 1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html?
Source: 1https.exe, 00000010.00000002.2484061604.000000C000360000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html?gt=z2744p8252&j=9088w940t8
Source: 1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.php
Source: 1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.phphttp://marnyonline.com/oauth2/p
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/php/oauth/samples.html
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/php/oauth/samples.html?
Source: 1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/php/oauth/samples.html?cv=65202q943&h=4020r461y0
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/php/oauth/samples.html?http://marnyonline.com/php/oauth/samples.html?NO_PROXY
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/php/oauth/samples.php
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.com/php/oauth/samples.phphttp://marnyonline.com/php/oauth/samples.html
Source: 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.comWinHttpGetProxyForUrl
Source: 1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.comWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonline.comWinHttpGetProxyForU
Source: 1https.exe, 00000010.00000002.2480062469.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.comage-encryption.org/v1
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comtime:
Source: 1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://marnyonline.comtime:
Source: 1https.exe, 00000000.00000002.2480038503.000000C000072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://namespacessamples.phpBye
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ei=2744o8252&j=HTTP/1.1
Source: 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2488818852.000001E39FC97000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com
Source: 1https.exe, 00000000.00000002.2487235473.000001134EE6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/
Source: 1https.exe, 00000000.00000002.2485551869.000000C00041C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.html?
Source: 1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.html?a=40508942&lm=27448252
Source: 1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.html?a=40508942&lm=27448252P
Source: 1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.html?a=40508942&lm=27448252http://marnyonline.comage-encryption.org/v1
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001AA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.htmldiffie-hellman-group14-sha256
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001AA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.htmldiffie-hellman-group14-sha256y6=b
Source: 1https.exe, 00000000.00000002.2485551869.000000C00041C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.php
Source: 1https.exe, 00000000.00000002.2485551869.000000C00041C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/api.phphttps://marnyonline.com/api.html?
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.html
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.html?
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.html?NO_PROXYno_proxyHTTPS_PROXYhttps_proxyWinHttpGetIEPro
Source: 1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89
Source: 1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89http://marnyonline.comage-enc
Source: 1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89p
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.php
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/db/namespaces/api.phphttps://marnyonline.com/db/namespaces/api.htmlhttps://m
Source: 1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/https://marnyonline.com
Source: 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/https://marnyonline.commarnyonline.com:443%
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/https://marnyonline.commarnyonline.com:443tcpmarnyonline.com
Source: 1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/https://marnyonline.commarnyonline.com:443tcpmarnyonline.comhttps://marnyonl
Source: 1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/namespaces/namespaces/oauth2/samples.html
Source: 1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?
Source: 1https.exe, 00000010.00000002.2484061604.000000C000360000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?o=517793ab0&ug=37145mm538
Source: 1https.exe, 00000010.00000002.2484061604.000000C000360000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?o=517793ab0&ug=37145mm538https://m
Source: 1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/namespaces/namespaces/oauth2/samples.htmlhttps://marnyonline.com/namespaces/
Source: 1https.exe, 00000010.00000002.2480062469.000000C0000A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/namespaces/namespaces/oauth2/samples.phpO
Source: 1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.html
Source: 1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.html?N
Source: 1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.html?NO_PROXYno_proxyHTTPS_PROXYhttps_proxyWinHttpGetIEPr
Source: 1https.exe, 00000011.00000002.2483693954.000000C00021B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.html?pt=27d4e48252&r=775i0n2785
Source: 1https.exe, 00000011.00000002.2483693954.000000C00021B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.html?pt=27d4e48252&r=775i0n2785http://marnyonline.comage-
Source: 1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.html?w
Source: 1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.php
Source: 1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/oauth2callback/api.phphttps://marnyonline.com/oauth2callback/api.htmlhttps:/
Source: 1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html
Source: 1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2485551869.000000C00040C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?
Source: 1https.exe, 00000000.00000002.2485551869.000000C00040C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?http://marnyonlin
Source: 1https.exe, 00000000.00000002.2485551869.000000C00040E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?j=3259s9314&xz=54
Source: 1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.htmlhttps://marnyonlin
Source: 1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comWinHTTP:AutoDetectWinHttpSetTimeoutsWinHttpSetTimeouts
Source: 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comWinHTTP:AutoDetectWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonline.com
Source: 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comWinHttpGetProxyForUrl9
Source: 1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comage-encryption.org/v1
Source: 1https.exe, 00000010.00000002.2480062469.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comcommonpb/common.protosliverpb.Envelope.IDIDage-encryption.org/v1
Source: 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comhttp://marnyonline.com
Source: 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comhttps://marnyonline.comWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonlin
Source: 1https.exe, 00000010.00000002.2480062469.000000C0001A8000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2481682720.000000C0001A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comhttps://marnyonline.comhttps://marnyonline.com
Source: 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comtime:
Source: 1https.exe, 00000010.00000002.2480062469.000000C000086000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://o=517793ab0&ug=HTTP/1.1
Source: 1https.exe, 00000011.00000002.2483693954.000000C000336000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pt=27d4e48252&r=HTTP/1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999

Source: 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_6cf350bb-c

System Summary

Malicious sample detected (through community Yara rule)

Source: 1https.exe, type: SAMPLE	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown
Source: 1https.exe, type: SAMPLE	Matched rule: Detects Sliver implant cross-platform adversary emulation/red team Author: ditekSHen
Source: 00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown
Source: Process Memory Space: 1https.exe PID: 3644, type: MEMORYSTR	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown

Source: 1https.exe, type: SAMPLE	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14
Source: 1https.exe, type: SAMPLE	Matched rule: INDICATOR_TOOL_Sliver author = ditekSHen, description = Detects Sliver implant cross-platform adversary emulation/red team
Source: 00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14
Source: Process Memory Space: 1https.exe PID: 3644, type: MEMORYSTR	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14

Source: classification engine

Classification label: mal64.troj.winEXE@10/0@1/1

Source: C:\Users\user\Desktop\1https.exe	File opened: C:\Windows\system32\99e7913ee4f49540564594f4f7cf2a36295fa30e35adbd76f6119f32a5c99a4eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	File opened: C:\Windows\system32\35af682c01dcc1ef287081200d56e09da30522658d21b7b74e5f24e0befb8913AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	File opened: C:\Windows\system32\c4f65d6aad1ebb8e70058051d93c5e57e94b72eae3b38f553b4833ef76db68e8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	File opened: C:\Windows\system32\5470abc561522d8e551d89efe8c92ab5e05113fadb1bc0ebb57d1b0f6e424701AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior

Source: 1https.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1https.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: 1https.exe	Virustotal: Detection: 72%
Source: 1https.exe	ReversingLabs: Detection: 64%

Source: C:\Users\user\Desktop\1https.exe

File read: C:\Users\user\Desktop\1https.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1https.exe "C:\Users\user\Desktop\1https.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe /?
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe -?
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe /?	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe -?	Jump to behavior

Source: C:\Users\user\Desktop\1https.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 1https.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 1https.exe

Static file information: File size 17320960 > 1048576

Source: 1https.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0xa05600
Source: 1https.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x60fa00

Source: 1https.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 1https.exe

Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\1https.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\1https.exe TID: 424	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe TID: 3116	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe TID: 676	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe TID: 6016	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: 1https.exe, 00000011.00000002.2488818852.000001E39FC97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
Source: 1https.exe, 00000000.00000002.2487235473.000001134EE78000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2486341146.0000022B13095000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2485093578.000001E21BC03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe /?	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\1https.exe 1https.exe -?	Jump to behavior

Source: C:\Users\user\Desktop\1https.exe	Queries volume information: C:\Users\user\Desktop\1https.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Queries volume information: C:\Users\user\Desktop\1https.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Queries volume information: C:\Users\user\Desktop\1https.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1https.exe	Queries volume information: C:\Users\user\Desktop\1https.exe VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected Sliver Implants

Source: Yara match	File source: 1https.exe, type: SAMPLE
Source: Yara match	File source: 00000011.00000002.2481682720.000000C00016C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2484061604.000000C00024C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2484061604.000000C000225000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2481242678.000000C00013A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2481242678.000000C00023E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2481242678.000000C000168000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2481363679.000000C00016A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1230899221.00000000017D7000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 3644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 4152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 3540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 5280, type: MEMORYSTR

Remote Access Functionality

Yara detected Sliver Implants

Source: Yara match	File source: 1https.exe, type: SAMPLE
Source: Yara match	File source: 00000011.00000002.2481682720.000000C00016C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2484061604.000000C00024C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2484061604.000000C000225000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2481242678.000000C00013A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2481242678.000000C00023E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2481242678.000000C000168000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2481363679.000000C00016A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1230899221.00000000017D7000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 3644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 4152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 3540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1https.exe PID: 5280, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1https.exe	73%	Virustotal		Browse
1https.exe	65%	ReversingLabs	Win64.Trojan.SliverMarte

URLs

Source	Detection	Scanner	Label
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.phphttp://marnyonline.com/api	0%	Avira URL Cloud	safe
https://pt=27d4e48252&r=HTTP/1.1	0%	Avira URL Cloud	safe
http://marnyonline.com/php/oauth/samples.html?cv=65202q943&h=4020r461y0	0%	Avira URL Cloud	safe
https://marnyonline.comhttps://marnyonline.comhttps://marnyonline.com	0%	Avira URL Cloud	safe
https://marnyonline.com/	0%	Avira URL Cloud	safe
https://marnyonline.com/api.html?a=40508942&lm=27448252P	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89	0%	Avira URL Cloud	safe
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?	0%	Avira URL Cloud	safe
http://marnyonline.com/php/oauth/samples.html?	0%	Avira URL Cloud	safe
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?k=256l71421&ss=7i7179u27	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.php	0%	Avira URL Cloud	safe
http://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comtime:	0%	Avira URL Cloud	safe
https://marnyonline.com/api.htmldiffie-hellman-group14-sha256	0%	Avira URL Cloud	safe
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html?gt=z2744p8252&j=9088w940t8	0%	Avira URL Cloud	safe
https://marnyonline.com/api.htmldiffie-hellman-group14-sha256y6=b	0%	Avira URL Cloud	safe
http://marnyonline.com/php/oauth/samples.html?http://marnyonline.com/php/oauth/samples.html?NO_PROXY	0%	Avira URL Cloud	safe
http://marnyonline.com/namespaces/database/samples.html	0%	Avira URL Cloud	safe
https://marnyonline.com/https://marnyonline.commarnyonline.com:443tcpmarnyonline.comhttps://marnyonl	0%	Avira URL Cloud	safe
https://ei=2744o8252&j=HTTP/1.1	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89p	0%	Avira URL Cloud	safe
https://marnyonline.comhttp://marnyonline.com	0%	Avira URL Cloud	safe
https://marnyonline.com/https://marnyonline.com	0%	Avira URL Cloud	safe
http://marnyonline.com/http://marnyonli	0%	Avira URL Cloud	safe
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.htmlhttp://marnyonline.	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.html?w	0%	Avira URL Cloud	safe
http://k=256l71421&ss=HTTP/1.1	0%	Avira URL Cloud	safe
https://o=517793ab0&ug=HTTP/1.1	0%	Avira URL Cloud	safe
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.php	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.html?N	0%	Avira URL Cloud	safe
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.phphttps://marnyonline.com/oauth2callback/api.htmlhttps:/	0%	Avira URL Cloud	safe
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?o=517793ab0&ug=37145mm538https://m	0%	Avira URL Cloud	safe
http://marnyonline.com/namespaces/database/samples.html?Mozilla/5.0	0%	Avira URL Cloud	safe
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?http://marnyonlin	0%	Avira URL Cloud	safe
http://namespacessamples.phpBye	0%	Avira URL Cloud	safe
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html	0%	Avira URL Cloud	safe
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.html?	0%	Avira URL Cloud	safe
http://marnyonline.com/namespaces/database/samples.phphttp://marnyonline.com/namespaces/database/sam	0%	Avira URL Cloud	safe
http://marnyonline.comtime:	0%	Avira URL Cloud	safe
https://marnyonline.com/api.php	0%	Avira URL Cloud	safe
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html?	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.html?pt=27d4e48252&r=775i0n2785	0%	Avira URL Cloud	safe
http://marnyonline.com/namespaces/database/samples.html?i_=77g17927z1&t=842374m83	0%	Avira URL Cloud	safe
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html?	0%	Avira URL Cloud	safe
http://cv=65202q943&h=HTTP/1.1	0%	Avira URL Cloud	safe
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.php	0%	Avira URL Cloud	safe
http://marnyonline.com/php/oauth/samples.html	0%	Avira URL Cloud	safe
https://marnyonline.comcommonpb/common.protosliverpb.Envelope.IDIDage-encryption.org/v1	0%	Avira URL Cloud	safe
https://marnyonline.com/namespaces/namespaces/oauth2/samples.htmlhttps://marnyonline.com/namespaces/	0%	Avira URL Cloud	safe
http://gt=z2744p8252&j=HTTP/1.1	0%	Avira URL Cloud	safe
https://marnyonline.comWinHTTP:AutoDetectWinHttpSetTimeoutsWinHttpSetTimeouts	0%	Avira URL Cloud	safe
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?j=3259s9314&xz=54	0%	Avira URL Cloud	safe
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html	0%	Avira URL Cloud	safe
http://marnyonline.com/php/oauth/samples.phphttp://marnyonline.com/php/oauth/samples.html	0%	Avira URL Cloud	safe
http://marnyonline.com/namespaces/database/samples.html?i_=77g17927z1&t=842374m83Mozilla/5.0	0%	Avira URL Cloud	safe
https://marnyonline.com/https://marnyonline.commarnyonline.com:443%	0%	Avira URL Cloud	safe
https://marnyonline.com	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.php	0%	Avira URL Cloud	safe
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?n	0%	Avira URL Cloud	safe
http://marnyonline.comage-encryption.org/v1	0%	Avira URL Cloud	safe
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89http://marnyonline.comage-enc	0%	Avira URL Cloud	safe
http://marnyonline.com/namespaces/database/samples.php	0%	Avira URL Cloud	safe
https://marnyonline.com/api.phphttps://marnyonline.com/api.html?	0%	Avira URL Cloud	safe
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.phphttp://marnyonline.com/oauth2/p	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.html?pt=27d4e48252&r=775i0n2785http://marnyonline.comage-	0%	Avira URL Cloud	safe
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html?ab=7717c9271&m=764	0%	Avira URL Cloud	safe
https://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comtime:	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.html?NO_PROXYno_proxyHTTPS_PROXYhttps_proxyWinHttpGetIEPro	0%	Avira URL Cloud	safe
http://marnyonline.com/http://marnyonline.commarnyonline.com:80sWGetExtendedUdpTableCreateToolhelp32	0%	Avira URL Cloud	safe
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.htmlhttps://marnyonlin	0%	Avira URL Cloud	safe
https://marnyonline.comhttps://marnyonline.comWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonlin	0%	Avira URL Cloud	safe
http://marnyonline.com	0%	Avira URL Cloud	safe
https://marnyonline.comage-encryption.org/v1	0%	Avira URL Cloud	safe
https://marnyonline.com/api.html?a=40508942&lm=27448252	0%	Avira URL Cloud	safe
https://marnyonline.com/namespaces/namespaces/oauth2/samples.phpO	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.html	0%	Avira URL Cloud	safe
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?	0%	Avira URL Cloud	safe
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?o=517793ab0&ug=37145mm538	0%	Avira URL Cloud	safe
http://marnyonline.comWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonline.comWinHttpGetProxyForU	0%	Avira URL Cloud	safe
http://marnyonline.com/php/oauth/samples.php	0%	Avira URL Cloud	safe
https://marnyonline.com/oauth2callback/api.html?NO_PROXYno_proxyHTTPS_PROXYhttps_proxyWinHttpGetIEPr	0%	Avira URL Cloud	safe
http://marnyonline.comWinHttpGetProxyForUrl	0%	Avira URL Cloud	safe
https://marnyonline.com/api.html?a=40508942&lm=27448252http://marnyonline.comage-encryption.org/v1	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.html	0%	Avira URL Cloud	safe
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.php	0%	Avira URL Cloud	safe
https://marnyonline.com/api.html?	0%	Avira URL Cloud	safe
https://marnyonline.com/db/namespaces/api.phphttps://marnyonline.com/db/namespaces/api.htmlhttps://m	0%	Avira URL Cloud	safe
http://marnyonline.com/http://marnyonline.commarnyonline.com:80	0%	Avira URL Cloud	safe
https://marnyonline.comWinHTTP:AutoDetectWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonline.com	0%	Avira URL Cloud	safe
http://marnyonline.com/http://marnyonline.commarnyonline.com:80tcpmarnyonline.comhttp://marnyonline.	0%	Avira URL Cloud	safe
http://marnyonline.com/	0%	Avira URL Cloud	safe
https://marnyonline.comWinHttpGetProxyForUrl9	0%	Avira URL Cloud	safe
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html	0%	Avira URL Cloud	safe
http://i_=77g17927z1&t=HTTP/1.1	0%	Avira URL Cloud	safe
http://marnyonline.com/namespaces/database/samples.html?	0%	Avira URL Cloud	safe
https://marnyonline.com/https://marnyonline.commarnyonline.com:443tcpmarnyonline.com	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
marnyonline.com	45.61.169.127	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://marnyonline.com/api.html?a=40508942&lm=27448252P	1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.phphttp://marnyonline.com/api	1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pt=27d4e48252&r=HTTP/1.1	1https.exe, 00000011.00000002.2483693954.000000C000336000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89	1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/php/oauth/samples.html?cv=65202q943&h=4020r461y0	1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?	1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2485551869.000000C00040C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/	1https.exe, 00000000.00000002.2487235473.000001134EE6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comhttps://marnyonline.comhttps://marnyonline.com	1https.exe, 00000010.00000002.2480062469.000000C0001A8000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2481682720.000000C0001A8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?k=256l71421&ss=7i7179u27	1https.exe, 00000011.00000002.2483693954.000000C00037C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/php/oauth/samples.html?	1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.php	1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comtime:	1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/api.htmldiffie-hellman-group14-sha256	1https.exe, 00000000.00000002.2481363679.000000C0001AA000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html?gt=z2744p8252&j=9088w940t8	1https.exe, 00000010.00000002.2484061604.000000C000360000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/https://marnyonline.commarnyonline.com:443tcpmarnyonline.comhttps://marnyonl	1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/api.htmldiffie-hellman-group14-sha256y6=b	1https.exe, 00000000.00000002.2481363679.000000C0001AA000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/php/oauth/samples.html?http://marnyonline.com/php/oauth/samples.html?NO_PROXY	1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/namespaces/database/samples.html	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ei=2744o8252&j=HTTP/1.1	1https.exe, 00000012.00000002.2481242678.000000C0001CC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89p	1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comhttp://marnyonline.com	1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/http://marnyonli	1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.htmlhttp://marnyonline.	1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/https://marnyonline.com	1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.html?w	1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://k=256l71421&ss=HTTP/1.1	1https.exe, 00000011.00000002.2483693954.000000C000336000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.php	1https.exe, 00000000.00000002.2480038503.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://o=517793ab0&ug=HTTP/1.1	1https.exe, 00000010.00000002.2480062469.000000C000086000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.html?N	1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html	1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.phphttps://marnyonline.com/oauth2callback/api.htmlhttps:/	1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?o=517793ab0&ug=37145mm538https://m	1https.exe, 00000010.00000002.2484061604.000000C000360000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?http://marnyonlin	1https.exe, 00000000.00000002.2485551869.000000C00040C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/namespaces/database/samples.html?Mozilla/5.0	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://namespacessamples.phpBye	1https.exe, 00000000.00000002.2480038503.000000C000072000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html	1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?	1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.html?	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/namespaces/database/samples.phphttp://marnyonline.com/namespaces/database/sam	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/api.php	1https.exe, 00000000.00000002.2485551869.000000C00041C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.comtime:	1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html?	1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.html?pt=27d4e48252&r=775i0n2785	1https.exe, 00000011.00000002.2483693954.000000C00021B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/namespaces/database/samples.html?i_=77g17927z1&t=842374m83	1https.exe, 00000012.00000002.2480038517.000000C000072000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html?	1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/php/oauth/samples.html	1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.php	1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cv=65202q943&h=HTTP/1.1	1https.exe, 00000000.00000002.2480038503.000000C000072000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comcommonpb/common.protosliverpb.Envelope.IDIDage-encryption.org/v1	1https.exe, 00000010.00000002.2480062469.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/namespaces/namespaces/oauth2/samples.htmlhttps://marnyonline.com/namespaces/	1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comWinHTTP:AutoDetectWinHttpSetTimeoutsWinHttpSetTimeouts	1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gt=z2744p8252&j=HTTP/1.1	1https.exe, 00000010.00000002.2480062469.000000C000086000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.html?j=3259s9314&xz=54	1https.exe, 00000000.00000002.2485551869.000000C00040E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.html	1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/php/oauth/samples.phphttp://marnyonline.com/php/oauth/samples.html	1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/namespaces/database/samples.html?i_=77g17927z1&t=842374m83Mozilla/5.0	1https.exe, 00000012.00000002.2480038517.000000C000072000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com	1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2488818852.000001E39FC97000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/https://marnyonline.commarnyonline.com:443%	1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.php	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.html?n	1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.comage-encryption.org/v1	1https.exe, 00000010.00000002.2480062469.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html	1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.html?ei=2744o8252&j=551053k89http://marnyonline.comage-enc	1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/namespaces/database/samples.php	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/oauth2/php/oauth2/db/oauth/api/php/samples.phphttp://marnyonline.com/oauth2/p	1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/api.phphttps://marnyonline.com/api.html?	1https.exe, 00000000.00000002.2485551869.000000C00041C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.html?pt=27d4e48252&r=775i0n2785http://marnyonline.comage-	1https.exe, 00000011.00000002.2483693954.000000C00021B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.html?NO_PROXYno_proxyHTTPS_PROXYhttps_proxyWinHttpGetIEPro	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html?ab=7717c9271&m=764	1https.exe, 00000000.00000002.2481363679.000000C000132000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comhttps://marnyonline.comhttps://marnyonline.comtime:	1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/http://marnyonline.commarnyonline.com:80sWGetExtendedUdpTableCreateToolhelp32	1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/php/php/db/oauth2callback/oauth2callback/database/api.htmlhttps://marnyonlin	1https.exe, 00000000.00000002.2480038503.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comhttps://marnyonline.comWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonlin	1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com	1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2487235473.000001134EE6C000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2488818852.000001E39FC97000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2485093578.000001E21BBF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comage-encryption.org/v1	1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2480038517.000000C00005C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/api.html?a=40508942&lm=27448252	1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/namespaces/namespaces/oauth2/samples.phpO	1https.exe, 00000010.00000002.2480062469.000000C0000A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.html	1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?	1https.exe, 00000010.00000002.2484061604.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/php/oauth/samples.php	1https.exe, 00000000.00000002.2481363679.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/namespaces/namespaces/oauth2/samples.html?o=517793ab0&ug=37145mm538	1https.exe, 00000010.00000002.2484061604.000000C000360000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/oauth2callback/api.html?NO_PROXYno_proxyHTTPS_PROXYhttps_proxyWinHttpGetIEPr	1https.exe, 00000011.00000002.2480211680.000000C000076000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.comWinHttpGetProxyForUrl	1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.comWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonline.comWinHttpGetProxyForU	1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/api.html?a=40508942&lm=27448252http://marnyonline.comage-encryption.org/v1	1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.html	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/api/namespaces/database/oauth2/php/database/api.php	1https.exe, 00000011.00000002.2483693954.000000C0002E4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/http://marnyonline.commarnyonline.com:80	1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/api.html?	1https.exe, 00000000.00000002.2485551869.000000C00041C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/db/namespaces/api.phphttps://marnyonline.com/db/namespaces/api.htmlhttps://m	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comWinHTTP:AutoDetectWinHttpSetTimeoutsWinHttpSetTimeoutshttps://marnyonline.com	1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.comWinHttpGetProxyForUrl9	1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/	1https.exe, 00000000.00000003.2165989054.000001134EEA3000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2486341146.0000022B13087000.00000004.00000020.00020000.00000000.sdmp, 1https.exe, 00000011.00000002.2480211680.000000C00007A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2481242678.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000012.00000002.2485093578.000001E21BBF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/http://marnyonline.commarnyonline.com:80tcpmarnyonline.comhttp://marnyonline.	1https.exe, 00000000.00000002.2485551869.000000C00040A000.00000004.00001000.00020000.00000000.sdmp, 1https.exe, 00000010.00000002.2480062469.000000C00008A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/db/oauth2callback/oauth2callback/oauth/oauth2/samples.html	1https.exe, 00000000.00000002.2480038503.000000C000048000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i_=77g17927z1&t=HTTP/1.1	1https.exe, 00000012.00000002.2481242678.000000C0001CC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://marnyonline.com/namespaces/database/samples.html?	1https.exe, 00000012.00000002.2481242678.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marnyonline.com/https://marnyonline.commarnyonline.com:443tcpmarnyonline.com	1https.exe, 00000000.00000002.2481363679.000000C0001A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.61.169.127	marnyonline.com	United States		8100	ASN-QUADRANET-GLOBALUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1645365
Start date and time:	2025-03-21 17:42:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1https.exe
Detection:	MAL
Classification:	mal64.troj.winEXE@10/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 184.31.69.3, 184.86.251.25, 204.79.197.222, 13.107.136.254, 52.123.128.254, 52.113.196.254, 204.79.197.254, 150.171.27.254
Excluded domains from analysis (whitelisted): spo-ring.msedge.net, www.bing.com, fp.msedge.net, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.svc.static.microsoft, dual-s-ring.msedge.net, a-ring.msedge.net, crl3.digicert.com, teams-ring.msedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
12:42:54	API Interceptor	10x Sleep call for process: 1https.exe modified

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 41
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 17:42:55.658092976 CET	49713	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:55.658138037 CET	443	49713	45.61.169.127	192.168.2.17
Mar 21, 2025 17:42:55.658231020 CET	49713	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:55.658620119 CET	49713	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:55.658637047 CET	443	49713	45.61.169.127	192.168.2.17
Mar 21, 2025 17:42:55.790884972 CET	443	49713	45.61.169.127	192.168.2.17
Mar 21, 2025 17:42:55.812328100 CET	49714	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:55.947844028 CET	80	49714	45.61.169.127	192.168.2.17
Mar 21, 2025 17:42:56.463490009 CET	49714	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:56.600975037 CET	80	49714	45.61.169.127	192.168.2.17
Mar 21, 2025 17:42:57.111485958 CET	49714	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:57.244282961 CET	80	49714	45.61.169.127	192.168.2.17
Mar 21, 2025 17:42:57.749594927 CET	49714	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:57.884582043 CET	80	49714	45.61.169.127	192.168.2.17
Mar 21, 2025 17:42:58.386585951 CET	49714	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:42:58.517846107 CET	80	49714	45.61.169.127	192.168.2.17
Mar 21, 2025 17:43:58.539201021 CET	49975	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:43:58.539254904 CET	443	49975	45.61.169.127	192.168.2.17
Mar 21, 2025 17:43:58.539356947 CET	49975	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:43:58.539752960 CET	49975	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:43:58.539767981 CET	443	49975	45.61.169.127	192.168.2.17
Mar 21, 2025 17:43:58.677695990 CET	443	49975	45.61.169.127	192.168.2.17
Mar 21, 2025 17:43:58.686364889 CET	49976	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:43:58.819638014 CET	80	49976	45.61.169.127	192.168.2.17
Mar 21, 2025 17:43:59.330823898 CET	49976	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:43:59.464781046 CET	80	49976	45.61.169.127	192.168.2.17
Mar 21, 2025 17:43:59.970808983 CET	49976	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:00.103023052 CET	80	49976	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:00.608840942 CET	49976	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:00.742038012 CET	80	49976	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:01.246848106 CET	49976	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:01.380930901 CET	80	49976	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:28.587378979 CET	49994	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:28.587430000 CET	443	49994	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:28.587573051 CET	49994	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:28.587997913 CET	49994	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:28.588011026 CET	443	49994	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:28.722455025 CET	443	49994	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:28.738410950 CET	49995	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:28.871742964 CET	80	49995	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:29.373522997 CET	49995	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:29.506165028 CET	80	49995	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:30.009526014 CET	49995	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:30.141503096 CET	80	49995	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:30.644690990 CET	49995	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:38.646420002 CET	49995	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:38.780046940 CET	80	49995	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:38.849857092 CET	49997	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:38.849917889 CET	443	49997	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:38.850069046 CET	49997	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:38.850474119 CET	49997	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:38.850507021 CET	443	49997	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:38.982496977 CET	443	49997	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:38.994415045 CET	49998	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:39.126626968 CET	80	49998	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:39.628520012 CET	49998	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:39.759944916 CET	80	49998	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:40.268536091 CET	49998	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:40.399794102 CET	80	49998	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:40.905556917 CET	49998	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:41.036134958 CET	80	49998	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:41.543427944 CET	49998	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:41.675198078 CET	80	49998	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:44.119976044 CET	49999	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:44.120029926 CET	443	49999	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:44.120269060 CET	49999	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:44.121143103 CET	49999	443	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:44.121153116 CET	443	49999	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:44.254183054 CET	443	49999	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:44.267765999 CET	50000	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:44.400511980 CET	80	50000	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:44.909871101 CET	50000	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:45.048017979 CET	80	50000	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:45.563858986 CET	50000	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:45.697731018 CET	80	50000	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:46.200892925 CET	50000	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:46.333267927 CET	80	50000	45.61.169.127	192.168.2.17
Mar 21, 2025 17:44:46.839962006 CET	50000	80	192.168.2.17	45.61.169.127
Mar 21, 2025 17:44:46.972285986 CET	80	50000	45.61.169.127	192.168.2.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 17:42:55.370594025 CET	52131	53	192.168.2.17	1.1.1.1
Mar 21, 2025 17:42:55.655073881 CET	53	52131	1.1.1.1	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 21, 2025 17:42:55.370594025 CET	192.168.2.17	1.1.1.1	0xa0af	Standard query (0)	marnyonline.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 21, 2025 17:42:55.655073881 CET	1.1.1.1	192.168.2.17	0xa0af	No error (0)	marnyonline.com		45.61.169.127	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

• 1https.exe
• rundll32.exe
• cmd.exe
• conhost.exe
• 1https.exe
• 1https.exe
• 1https.exe

Click to jump to process

Memory Usage

• 1https.exe
• rundll32.exe
• cmd.exe
• conhost.exe
• 1https.exe
• 1https.exe
• 1https.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Click to jump to process

Target ID:	0
Start time:	12:42:53
Start date:	21/03/2025
Path:	C:\Users\user\Desktop\1https.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1https.exe"
Imagebase:	0xdd0000
File size:	17'320'960 bytes
MD5 hash:	3F6DD6C85F9E9A02FDEA20076F69B66D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000000.00000002.2481363679.000000C00016A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Multi_Trojan_Bishopsliver_42298c4a, Description: unknown, Source: 00000000.00000000.1230899221.0000000001A44000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000000.00000000.1230899221.00000000017D7000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	12:44:00
Start date:	21/03/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6f15e0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:44:14
Start date:	21/03/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe"
Imagebase:	0x7ff683fb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:44:14
Start date:	21/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62a120000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:44:27
Start date:	21/03/2025
Path:	C:\Users\user\Desktop\1https.exe
Wow64 process (32bit):	false
Commandline:	1https.exe
Imagebase:	0xdd0000
File size:	17'320'960 bytes
MD5 hash:	3F6DD6C85F9E9A02FDEA20076F69B66D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000010.00000002.2484061604.000000C00024C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000010.00000002.2484061604.000000C000225000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	12:44:37
Start date:	21/03/2025
Path:	C:\Users\user\Desktop\1https.exe
Wow64 process (32bit):	false
Commandline:	1https.exe /?
Imagebase:	0xdd0000
File size:	17'320'960 bytes
MD5 hash:	3F6DD6C85F9E9A02FDEA20076F69B66D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000011.00000002.2481682720.000000C00016C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	12:44:43
Start date:	21/03/2025
Path:	C:\Users\user\Desktop\1https.exe
Wow64 process (32bit):	false
Commandline:	1https.exe -?
Imagebase:	0xdd0000
File size:	17'320'960 bytes
MD5 hash:	3F6DD6C85F9E9A02FDEA20076F69B66D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000012.00000002.2481242678.000000C00013A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000012.00000002.2481242678.000000C00023E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000012.00000002.2481242678.000000C000168000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	http://t.dripemail2.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzQyNDg1MjAxLCJuYmYiOjE3NDI0ODUyMDEsImFjY291bnRfaWQiOiI5MjExNzMxIiwiZGVsaXZlcnlfaWQiOiI2ZGY2cmIydXVwbjY4cnNhdWo0NCIsInRva2VuIjoiNmRmNnJiMnV1cG42OHJzYXVqNDQiLCJzZW5kX2F0IjoxNzQyNDgzOTQ4LCJlbWFpbF9pZCI6MTA1MDc4ODcsImVtYWlsYWJsZV90eXBlIjoiQnJvYWRjYXN0IiwiZW1haWxhYmxlX2lkIjo0MTkzMDc4LCJ1cmwiOiJodHRwOi8vZ2NyLnVwcGxleC5jby5rZT9fX3M9cWMwZ2JsdTk1emZnYmh3ZHp5OG4mdXRtX3NvdXJjZT1kcmlwJnV0bV9tZWRpdW09ZW1haWwmdXRtX2NhbXBhaWduPVdlK2dvdCthK21ha2VvdmVyLiJ9.nJ9tzd3-jhbWgSNwRLHamHKYwZXuNcZIG2E1QBFM5fg	Get hash	malicious	HTMLPhisher	Browse	45.61.169.110
	ATT11027.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	http://url5681.planter.eco/ls/click?upn=u001.PX1-2BssefkOe686e7wTSUMqibxN-2FCUadbAKgpTv23cYOIQxMvH9FGLuwPON-2Ft4V08mI3EhMVAoZnU-2Br4hRroTgY6212B0nGnr8aV-2B5ZtDZ10DmDDkH6mdlmAzG8M-2BiNsGPGMX1iPzlrrdaY9R4kk4qHfVergkdfGzm-2BAmGL-2FwYqLpCth-2FU-2ByXRztop6mHKwMCk43gAzvI9DCKmBcEcJQKyQ-3D-3Da5U3_GwWzR5CPD3uhhoxi7nJtY0-2BQC5TKRtJEXtldUtgGNIU9EPMkwXhPBMhFexKYRqOhYUH1k-2FQVOT9D8S6mnbGzOTVeFZqZ2eiXdrD6GdHPzzO106h29UdS-2BIz4v5acd9FnatQanlGtMNJsbvRJRS5dF6-2BMeTnNy39wilhlMfgiqmmr792hlZiyIO30hIfNO7fmE4Qvw7CYEB9aPKMoYkpeVA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.245.240.188
	AVISO DE COBRO DHL - 1606604473.PDF.exe	Get hash	malicious	DarkCloud	Browse	204.44.192.90
	splx86.elf	Get hash	malicious	Unknown	Browse	64.189.38.253
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	104.247.172.118
	https://office.mx-senora.com/validate-captcha?user_id=4bP8rZrJvBAKS5wfleIW	Get hash	malicious	Unknown	Browse	45.61.166.78
	Factura - FAT120250320.pdf(94KB).com.exe	Get hash	malicious	DarkTortilla, XWorm	Browse	104.245.240.123
	huawei.elf	Get hash	malicious	Mirai	Browse	104.223.82.201
	Play_VM-Now(bfrieden)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.1206426879766145
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	1https.exe
File size:	17'320'960 bytes
MD5:	3f6dd6c85f9e9a02fdea20076f69b66d
SHA1:	378b9c81eaa3cb51179a436ecb293d4da46fb66a
SHA256:	89b49994b3ab46875d0128673c87f15854bee5aff7ed13a812035c91a988636c
SHA512:	e790eb3de997dac1f22e392afed13d9b8fc848229c8f1ccbde0c237bfa97b5a59af86b33d5b541311a2c0bcb8ab348e64cbd4d05bea3906347629204a074fc91
SSDEEP:	98304:V3s7mObQ7J2DDDUxz+zSBLlHdT29+5WxVovgp9EaXZLOxs39nD:9sKiykPkBBPT298WxVovgpu2ZrD
TLSH:	E1071A03F8951095D8B6D1B089218162FA70785C0B7973DF2B61F7B42B72BF49EBA790
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........J........"......V..."................@..............................p............`... ............................

Entrypoint:	0x45d0e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	f0ea7b7844bbc5bfa9bb32efdcea957c

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10c8000	0x490	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10c9000	0x2cba8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1017040	0x148	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa0545d	0xa05600	70a79c4c8148653252383d98df208895	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa07000	0x60f9c0	0x60fa00	c9ec2cdd8bd2beb43287e13d9c4c6b46	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1017000	0xb04f0	0x42200	cff480a34ba3c84cb1433ef56bfad823	False	0.38640122873345933	data	4.766100052123223	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10c8000	0x490	0x600	2de8cfa279b681a3b3b28dc4e0b9db8c	False	0.3365885416666667	data	3.756870989745463	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x10c9000	0x2cba8	0x2cc00	9a1d445ff529b1f9ba1926f86277c092	False	0.13103941166201116	data	5.445059390091143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x10f6000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1https.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
1https.exe