Windows
Analysis Report
SecuriteInfo.com.Win32.Malware-gen.881.30761.exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Classification
- System is w10x64
SecuriteInfo.com.Win32.Malware-gen.881.30761.exe (PID: 6448 cmdline:
"C:\Users\ user\Deskt op\Securit eInfo.com. Win32.Malw are-gen.88 1.30761.ex e" MD5: BB16DDE30B851185630CCDC3416B29B8) chrome.exe (PID: 5812 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --di sable-fre --no-defau lt-browser -check --n o-first-ru n --no-san dbox --all ow-no-sand box-job -- disable-gp u --mute-a udio --dis able-audio --user-da ta-dir="C: \Users\use r\AppData\ Local\Temp \td0ahvdy. dga" MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 4224 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-G B --servic e-sandbox- type=none --no-sandb ox --mute- audio --us er-data-di r="C:\User s\user\App Data\Local \Temp\td0a hvdy.dga" --no-pre-r ead-main-d ll --field -trial-han dle=2292,i ,162516720 8089836583 2,15422658 6573321934 89,262144 --variatio ns-seed-ve rsion --mo jo-platfor m-channel- handle=231 6 /prefetc h:3 MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 6028 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=crashpa d-handler --user-dat a-dir=C:\U sers\user\ AppData\Lo cal\Temp\t d0ahvdy.dg a /prefetc h:4 --moni tor-self-a nnotation= ptype=cras hpad-handl er --datab ase=C:\Use rs\user\Ap pData\Loca l\Temp\td0 ahvdy.dga\ Crashpad - -metrics-d ir=C:\User s\user\App Data\Local \Temp\td0a hvdy.dga - -url=https ://clients 2.google.c om/cr/repo rt --annot ation=chan nel= --ann otation=pl at=Win64 - -annotatio n=prod=Chr ome --anno tation=ver =134.0.699 8.36 --ini tial-clien t-data=0x1 04,0x108,0 x10c,0x100 ,0xdc,0x7f fbfb814f38 ,0x7ffbfb8 14f44,0x7f fbfb814f50 MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 7352 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=rendere r --user-d ata-dir="C :\Users\us er\AppData \Local\Tem p\td0ahvdy .dga" --en able-dinos aur-easter -egg-alt-i mages --no -pre-read- main-dll - -no-sandbo x --disabl e-gpu-comp ositing -- video-capt ure-use-gp u-memory-b uffer --la ng=en-GB - -device-sc ale-factor =1 --num-r aster-thre ads=2 --en able-main- frame-befo re-activat ion --rend erer-clien t-id=9 --t ime-ticks- at-unix-ep och=-17456 9633236067 6 --launch -time-tick s=11304211 0 --field- trial-hand le=2292,i, 1625167208 0898365832 ,154226586 5733219348 9,262144 - -variation s-seed-ver sion --moj o-platform -channel-h andle=4056 /prefetch :1 MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 7364 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=rendere r --user-d ata-dir="C :\Users\us er\AppData \Local\Tem p\td0ahvdy .dga" --ex tension-pr ocess --en able-dinos aur-easter -egg-alt-i mages --no -pre-read- main-dll - -no-sandbo x --disabl e-gpu-comp ositing -- video-capt ure-use-gp u-memory-b uffer --la ng=en-GB - -device-sc ale-factor =1 --num-r aster-thre ads=2 --en able-main- frame-befo re-activat ion --rend erer-clien t-id=10 -- time-ticks -at-unix-e poch=-1745 6963323606 76 --launc h-time-tic ks=1130471 45 --field -trial-han dle=2292,i ,162516720 8089836583 2,15422658 6573321934 89,262144 --variatio ns-seed-ve rsion --mo jo-platfor m-channel- handle=406 4 /prefetc h:2 MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 4552 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=rendere r --user-d ata-dir="C :\Users\us er\AppData \Local\Tem p\td0ahvdy .dga" --en able-dinos aur-easter -egg-alt-i mages --no -pre-read- main-dll - -no-sandbo x --disabl e-gpu-comp ositing -- video-capt ure-use-gp u-memory-b uffer --la ng=en-GB - -device-sc ale-factor =1 --num-r aster-thre ads=2 --en able-main- frame-befo re-activat ion --rend erer-clien t-id=5 --t ime-ticks- at-unix-ep och=-17456 9633236067 6 --launch -time-tick s=11246275 3 --field- trial-hand le=2292,i, 1625167208 0898365832 ,154226586 5733219348 9,262144 - -variation s-seed-ver sion --moj o-platform -channel-h andle=3144 /prefetch :1 MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 4940 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= storage.mo jom.Storag eService - -lang=en-G B --servic e-sandbox- type=servi ce --no-sa ndbox --mu te-audio - -user-data -dir="C:\U sers\user\ AppData\Lo cal\Temp\t d0ahvdy.dg a" --no-pr e-read-mai n-dll --fi eld-trial- handle=229 2,i,162516 7208089836 5832,15422 6586573321 93489,2621 44 --varia tions-seed -version - -mojo-plat form-chann el-handle= 2464 /pref etch:8 MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 6904 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=gpu-pro cess --no- sandbox -- user-data- dir="C:\Us ers\user\A ppData\Loc al\Temp\td 0ahvdy.dga " --no-pre -read-main -dll --gpu -preferenc es=UAAAAAA AAADgAAAEA AAAAAAAAAA AAAAAAABgA AAAAAAAAAA AAAAAAAAAA AACAAAAAAA AAAAAAAAAA AAAAAAAABA AAAAAAAAAE AAAAAAAAAA IAAAAAAAAA AgAAAAAAAA A --use-gl =angle --u se-angle=s wiftshader -webgl --f ield-trial -handle=22 92,i,16251 6720808983 65832,1542 2658657332 193489,262 144 --vari ations-see d-version --mojo-pla tform-chan nel-handle =2288 /pre fetch:2 MD5: E81F54E6C1129887AEA47E7D092680BF)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-04-26T21:40:40.612117+0200 | 2856255 | 1 | Malware Command and Control Activity Detected | 192.168.2.7 | 49681 | 109.176.30.246 | 43001 | TCP |
- • AV Detection
- • Compliance
- • Spreading
- • Software Vulnerabilities
- • Networking
- • Key, Mouse, Clipboard, Microphone and Screen Capturing
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
- • Lowering of HIPS / PFW / Operating System Security Settings
- • Stealing of Sensitive Information
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Neural Call Log Analysis: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Memory has grown: |
Networking |
---|
Source: | Suricata IDS: |
Source: | TCP traffic: |
Source: | IP Address: |
Source: | ASN Name: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | String found in binary or memory: |