Windows Analysis Report
EI1Hc80wNB.exe

Overview

General Information

Sample name: EI1Hc80wNB.exe
renamed because original name is a hash value
Original sample name: 2642b50c1e869342695ac21d87731e83ddb24a89e152e5e3e82e61a7ce19e721.exe
Analysis ID: 1501763
MD5: 21e997bc9e3dedce298fd27b37dda78b
SHA1: fd3189b46f3c0b92cfc29b1da1bf72c927ce4f84
SHA256: 2642b50c1e869342695ac21d87731e83ddb24a89e152e5e3e82e61a7ce19e721
Tags: 120-46-149-112exe
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Uses known network protocols on non-standard ports
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Sigma detected: Communication To Uncommon Destination Ports

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: EI1Hc80wNB.exe ReversingLabs: Detection: 21%
Source: EI1Hc80wNB.exe Virustotal: Detection: 27% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: EI1Hc80wNB.exe Joe Sandbox ML: detected
Source: EI1Hc80wNB.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: EI1Hc80wNB.exe
Source: Binary string: o E:\Project\remote_cs\x64\Release\remote_cs.pdb source: EI1Hc80wNB.exe

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 8888
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.12:49710 -> 120.46.149.112:8888
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 120.46.149.112 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Code function: 0_2_00007FF6AF691000 malloc,InternetOpenW,InternetOpenUrlA,InternetReadFile,HeapCreate,SleepEx,RtlAllocateHeap,memcpy, 0_2_00007FF6AF691000
Source: global traffic HTTP traffic detected: GET /safekey HTTP/1.1User-Agent: myappHost: 120.46.149.112:8888Cache-Control: no-cache
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134F0000.00000004.00000020.00020000.00000000.sdmp, EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112/
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112/~
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134F0000.00000004.00000020.00020000.00000000.sdmp, EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134AD000.00000004.00000020.00020000.00000000.sdmp, EI1Hc80wNB.exe, 00000000.00000002.2451908642.000002221350D000.00000004.00000020.00020000.00000000.sdmp, EI1Hc80wNB.exe, 00000000.00000002.2451694657.0000006EFBEFA000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey
Source: EI1Hc80wNB.exe, 00000000.00000002.2451694657.0000006EFBEFA000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey6
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey:
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekeyez9
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekeyw9
Source: Amcache.hve.5.dr String found in binary or memory: http://upx.sf.net
Detected potential crypto function
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Code function: 0_2_00007FF6AF691000 0_2_00007FF6AF691000
One or more processes crash
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6528 -s 1104
Source: classification engine Classification label: mal60.troj.winEXE@2/5@0/1
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6528
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\279a147f-ef9a-410e-a5af-d856e1e7f8ab Jump to behavior
Source: EI1Hc80wNB.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: EI1Hc80wNB.exe ReversingLabs: Detection: 21%
Source: EI1Hc80wNB.exe Virustotal: Detection: 27%
Source: unknown Process created: C:\Users\user\Desktop\EI1Hc80wNB.exe "C:\Users\user\Desktop\EI1Hc80wNB.exe"
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6528 -s 1104
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: EI1Hc80wNB.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: EI1Hc80wNB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: EI1Hc80wNB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: EI1Hc80wNB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: EI1Hc80wNB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: EI1Hc80wNB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: EI1Hc80wNB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: EI1Hc80wNB.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: EI1Hc80wNB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: EI1Hc80wNB.exe
Source: Binary string: o E:\Project\remote_cs\x64\Release\remote_cs.pdb source: EI1Hc80wNB.exe
Source: EI1Hc80wNB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: EI1Hc80wNB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: EI1Hc80wNB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: EI1Hc80wNB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: EI1Hc80wNB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 8888
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe TID: 6532 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Thread delayed: delay time: 60000 Jump to behavior
Source: Amcache.hve.5.dr Binary or memory string: VMware
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.0000022213517000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr Binary or memory string: VMware-42 27 6e d0 59 6b 97 52-b4 9a 7f 42 1f 0e 66 9c
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.0000022213517000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWsCz(2:
Source: EI1Hc80wNB.exe, 00000000.00000002.2451908642.00000222134D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: Amcache.hve.5.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Code function: 0_2_00007FF6AF691918 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6AF691918
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Code function: 0_2_00007FF6AF691424 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF6AF691424
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Code function: 0_2_00007FF6AF691918 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6AF691918
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Code function: 0_2_00007FF6AF691AC0 SetUnhandledExceptionFilter, 0_2_00007FF6AF691AC0
Source: C:\Users\user\Desktop\EI1Hc80wNB.exe Code function: 0_2_00007FF6AF6917F0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF6AF6917F0
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.5.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1501763 Sample: EI1Hc80wNB.exe Startdate: 30/08/2024 Architecture: WINDOWS Score: 60 16 Multi AV Scanner detection for submitted file 2->16 18 Machine Learning detection for sample 2->18 20 Uses known network protocols on non-standard ports 2->20 22 AI detected suspicious sample 2->22 6 EI1Hc80wNB.exe 6 2->6         started        process3 dnsIp4 14 120.46.149.112, 49710, 8888 CNIX-APChinaNetworksInter-ExchangeCN China 6->14 9 WerFault.exe 19 16 6->9         started        process5 file6 12 C:\ProgramData\Microsoft\...\Report.wer, Unicode 9->12 dropped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
120.46.149.112
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://120.46.149.112:8888/safekey false
  • 4%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown