Windows Analysis Report
file.exe

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00D97D20 appears 55 times

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.2121335262.0000000000E09000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePeriblem.exe8 vs file.exe
Source: file.exe, 00000000.00000002.2121335262.0000000000E09000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePercursory.exe" vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.file.exe.e12030.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.file.exe.e12030.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.0.IDVNp0HKaI.exe.c60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.file.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: file.exe

Static PE information: Section: .cSs ZLIB complexity 0.9997935022026432

Source: 0.2.file.exe.e12030.1.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.e12030.1.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.e12030.1.raw.unpack, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.file.exe.e12030.1.raw.unpack, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/8@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3460:120:WilError_03

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

File created: C:\Users\user\AppData\Local\Temp\Tmp8D32.tmp

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: file.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe "C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe"
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\2p4HikHFep.exe "C:\Users\user\AppData\Roaming\2p4HikHFep.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe "C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\2p4HikHFep.exe "C:\Users\user\AppData\Roaming\2p4HikHFep.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: Google Chrome.lnk.4.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Source: 0.2.file.exe.e12030.1.raw.unpack, A2H1lUZ15GsIooGy4G.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),WGLh7hOZTTHiPyN9W5R(typeof(Type).TypeHandle)})

Source: IDVNp0HKaI.exe.0.dr

Static PE information: 0xFD0920A4 [Fri Jul 11 15:37:08 2104 UTC]

Source: file.exe

Static PE information: section name: .cSs

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCB9B6 push es; retn 0000h	0_2_00DCBAC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCBAD8 push es; retn 0000h	0_2_00DCBAC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCBAD8 push es; ret	0_2_00DCBAD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCBAC9 push es; retn 0000h	0_2_00DCBAC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCBAC9 push es; ret	0_2_00DCBAD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCBB45 push es; retf 0000h	0_2_00DCBB32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCBB45 push es; retf	0_2_00DCBB42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D976D3 push ecx; ret	0_2_00D976E6
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Code function: 4_2_05C30D5B push es; ret	4_2_05C30D62
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Code function: 4_2_05C4D412 push es; ret	4_2_05C4D420
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Code function: 4_2_05C4C710 push es; ret	4_2_05C4C720
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Code function: 4_2_05C4E060 push es; ret	4_2_05C4E070
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Code function: 4_2_05C4ECF2 push eax; ret	4_2_05C4ED01

Source: 0.2.file.exe.e12030.1.raw.unpack, Form1.cs	High entropy of concatenated method names: 'Form1_Load', 'ReadLine', 'Dispose', 'InitializeComponent', 'hslEVK0YRVYVdP1jXHL', 'nHatgm0EHFgWZCImUvw', 'My87Oi037f0J6nyYBa2', 'l1Ur4J0NP3FH6Qek9U5', 'gF2a0S0i574GHi2ycUO', 'zC0ylo0PPjQuylhoBwB'
Source: 0.2.file.exe.e12030.1.raw.unpack, FieldRoot20.cs	High entropy of concatenated method names: 'Field1', 'Field5', 'Field2', 'Field3', 'Field4', 'Key4Database', 'Key3Database', 'OTQYODHrh2PCjrwJJca', 'GhSPe4H1kMOaaXAJjwp', 'DR2pE4HBL2JniJJ3lba'
Source: 0.2.file.exe.e12030.1.raw.unpack, BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO.cs	High entropy of concatenated method names: 'Dispose', 'O1pymx7hA8CjnLAqW28', 'jVK9lT7zl436RGeqiCa', 'NbG9wubF0AEhqGBl0QJ', 'dj9joF7lIXF3rDvvFO2', 'CD921P7cQYZf5yLoGqu', 'DbOZkebBIX3Vx1pFO4W', 'atLfBCbWroMA9UwqAPZ'
Source: 0.2.file.exe.e12030.1.raw.unpack, Auhi.cs	High entropy of concatenated method names: 'I\u04341', 'I\u04342', 'I\u04343', 'I\u04344', 'fHLr5CH0LU6ImQ7akQF', 'DSQ9uuH427Cyq88JbGj', 'OpZpxZH5SuapTriTOAq', 'FMqVPbH752glDSeMbJ8', 'bttmgrHbB3dpfPinxv7', 'coD56bHvCONb23BRE5L'
Source: 0.2.file.exe.e12030.1.raw.unpack, FieldRootRoot.cs	High entropy of concatenated method names: 'Field1', 'Jlu9ecHTegm8xw4UBKS', 'IoUvTMHDaYRRK7p0Krk', 'DAOsh9H9jHxvaTVMUf5', 'QIiwtMH6pslF5yF4C3J', 'Ioy7nwHdUXBKxGIvSG6', 'u7kpnOHAVwGu4JwNs51', 'XEvaHSHJffn3JsTsgZu'
Source: 0.2.file.exe.e12030.1.raw.unpack, CryptoHelper.cs	High entropy of concatenated method names: 'GetDecoded', 'DecryptBlob', 'cryptUnprotectData', 'GetMd5Hash', 'GetHexString', 'cHLGge4BTo1WYObO9uu', 'jODNO04WlKmh49YYT18', 'xVXJsi4roYFsdlriPbP', 'M6jOaJ0zaR01N0Glgqa', 'FF1htS4FvThRl3Aa8MZ'
Source: 0.2.file.exe.e12030.1.raw.unpack, BerkeleyDB.cs	High entropy of concatenated method names: 'Extract', 'L1aWba0RLYGrIYCqlO6', 't8M4Vf0Zbw9qDRCeaAm', 'LWeaqV08lEqIWpk7bd3', 'rmhgy00uP06nkvF8Efs', 'XCEbvI0SXCLbv0dApnF', 'vqlJpt0ljVOBL4eaFFE', 'CHa9Ho0c09E5U0VKeas', 'IDjZhW0QxCOiIw9gpMh', 'Tmcd2x0xZWUCvC8bwHv'
Source: 0.2.file.exe.e12030.1.raw.unpack, TripleDes.cs	High entropy of concatenated method names: 'ComputeVoid', 'Compute', 'DecryptStringDesCbc', 'DecryptByteDesCbc', 'C1UyGy5s0hwZN2YrF0L', 'glrIye5IBKHPbbK8XS2', 'pRyvfN5fMygJfYFMpox', 'dLNibF5grGAHmef5LVc', 'd25Gdl5wB5kyUj9s37m', 'HVR9FH5q4oDb9QIxa2C'
Source: 0.2.file.exe.e12030.1.raw.unpack, A2H1lUZ15GsIooGy4G.cs	High entropy of concatenated method names: 'KJLJqDCbaj3SN79lIbl', 'dnByv3CvObaojhogyiw', 'LtQPyoxJn7', 'O4cPg5CmZmFVqVM9q3A', 'vDYK2eCesvkMsoMEF5v', 'gk4k0wCksfELvtNF0ns', 'g38PJ8K3c0', 'AZCPHbxqQi', 'kjCPpoa2Hi', 'zssPO0JXVk'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\2p4HikHFep.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003130000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,
Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003130000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003130000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Memory allocated: 1640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Memory allocated: 5000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Memory allocated: 22D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Memory allocated: 2470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Memory allocated: 4470000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Window / User API: threadDelayed 7447			Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Window / User API: threadDelayed 957			Jump to behavior

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe TID: 516	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe TID: 4864	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe TID: 2168	Thread sleep count: 7447 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe TID: 2168	Thread sleep count: 957 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe TID: 5972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DAB6DA FindFirstFileExW,

0_2_00DAB6DA

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003130000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003130000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 2p4HikHFep.exe, 00000004.00000002.2291227679.0000000005EA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003130000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.00000000025A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.000000000367A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 2p4HikHFep.exe, 00000004.00000002.2286181882.0000000003755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D97AF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D97AF1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA913C mov eax, dword ptr fs:[00000030h]		0_2_00DA913C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA1496 mov ecx, dword ptr fs:[00000030h]		0_2_00DA1496

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DAEFC8 GetProcessHeap,

0_2_00DAEFC8

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D97AF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D97AF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D97C53 SetUnhandledExceptionFilter,	0_2_00D97C53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9DD68 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D9DD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D97D65 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D97D65

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe "C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\2p4HikHFep.exe "C:\Users\user\AppData\Roaming\2p4HikHFep.exe"			Jump to behavior

Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003259000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003259000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D977D0 cpuid

0_2_00D977D0

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00DAE815
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DA4128
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00DAEA68
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00DAEB91
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00DAEC97
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00DAE402
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00DAE5FD
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00DAED66
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DAE6EF
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DAE6A4
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00DA464E
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DAE78A

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Queries volume information: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Users\user\AppData\Roaming\2p4HikHFep.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D979E4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00D979E4

Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Yara detected PureLog Stealer

Source: 2p4HikHFep.exe, 00000004.00000002.2296674406.0000000006DB0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Source: Yara match	File source: 0.2.file.exe.e12030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.e12030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.IDVNp0HKaI.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2121335262.0000000000E09000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2119352114.0000000000C62000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.dc6030.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.2p4HikHFep.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.dc6030.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.2120030420.0000000000142000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2121335262.0000000000DC4000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IDVNp0HKaI.exe PID: 4568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2p4HikHFep.exe PID: 1512, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 0.2.file.exe.e12030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.e12030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.IDVNp0HKaI.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.00000000027D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: 2p4HikHFep.exe, 00000004.00000002.2296902829.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\*.json}
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: 2p4HikHFep.exe, 00000004.00000002.2296902829.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\*.json}
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q8C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: file.exe	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2p4HikHFep.exe PID: 1512, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.file.exe.e12030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.e12030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.IDVNp0HKaI.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2121335262.0000000000E09000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2119352114.0000000000C62000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.dc6030.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.2p4HikHFep.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.dc6030.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.2120030420.0000000000142000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2121335262.0000000000DC4000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IDVNp0HKaI.exe PID: 4568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2p4HikHFep.exe PID: 1512, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 0.2.file.exe.e12030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.e12030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.IDVNp0HKaI.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	11 Deobfuscate/Decode Files or Information	11 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	134 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	451 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	71%	ReversingLabs	Win32.Trojan.Seraph
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\2p4HikHFep.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe	37%	ReversingLabs	Win32.Trojan.Jalapeno

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Domains and IPs

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	2p4HikHFep.exe, 00000004.00000002.2286181882.00000000037D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.00000000027D7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15V	2p4HikHFep.exe, 00000004.00000002.2282949938.00000000027B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id4	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp, 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.000000000271B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/users/	IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003130000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb/ip	IDVNp0HKaI.exe, 00000002.00000002.2141471443.0000000003063000.00000004.00000800.00020000.00000000.sdmp, 2p4HikHFep.exe, 00000004.00000000.2120030420.0000000000142000.00000002.00000001.01000000.00000006.sdmp, 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp, 2p4HikHFep.exe.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2p4HikHFep.exe, 00000004.00000002.2286181882.00000000037D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp, 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	2p4HikHFep.exe, 00000004.00000002.2286181882.00000000037D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.000000000271B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.000000000271B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp, 2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.00000000026C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Response	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17ResponseD	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	2p4HikHFep.exe, 00000004.00000002.2282949938.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
65.21.18.51	unknown	United States		199592	CP-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521605
Start date and time:	2024-09-29 01:00:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/8@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 118 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
19:01:36	API Interceptor	43x Sleep call for process: 2p4HikHFep.exe modified

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Process:	C:\Users\user\AppData\Roaming\2p4HikHFep.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:17 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.467262442226708
Encrypted:	false
SSDEEP:	48:8S4d5TvGk0lRYrnvPdAKRkdAGdAKRFdAKR6P:8SSbH7
MD5:	55342943CC12E243AB7A0947AABA3332
SHA1:	83906C0D6EA81A9D02E049098104566D14B9691E
SHA-256:	9439C344A1D1CD025D4FD0024578D843B5AA4B7F6C83402D7A98493DAF9FC16F
SHA-512:	50E2790E9EF711049910FE2E53C31EC78A580FA19685C60975A33E559F4339072BB03D7317ED303C056C41B1EAB1945DCEFFF92E9408B96351B8FF786FEED06A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.....)..W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2p4HikHFep.exe.log

Process:	C:\Users\user\AppData\Roaming\2p4HikHFep.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IDVNp0HKaI.exe.log

Process:	C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\Tmp8D32.tmp

Process:	C:\Users\user\AppData\Roaming\2p4HikHFep.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp8D43.tmp

Process:	C:\Users\user\AppData\Roaming\2p4HikHFep.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\2p4HikHFep.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.082476369292545
Encrypted:	false
SSDEEP:	3072:Vq6EgY6iYrUjxQMbwPP9ktwT9N3TAVtYSK6VcZqf7D34teqiOLibBOc:cqY6i/wPCKN3TAbYgVcZqf7DIXL
MD5:	65C058E4A90D2EC70B03211D768B6ECC
SHA1:	BF5AF6F650759E5E612D42D72145660056737164
SHA-256:	5A00E3718AFB5BFB18A6B1C824B680015733F0403AF0D5663289A17BA8206CC3
SHA-512:	3D9114409F8096CE8A1D134A48235FBBAD0C6C53F820707A951BAC42C4F7BA6A38E98A50C9D929F049042263A7C0E24DA8368D3AA4E934F5DA79E9BDA4A930AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@.................................d...O.... ..............................H................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	501760
Entropy (8bit):	6.1274870659064
Encrypted:	false
SSDEEP:	6144:ChhuRs6j+uinO16pSuHugxyyyuf7CQHKCt/qXiZDo3xOxAAFQXNDHrg49/2CXfG:kuRR8YmpHug/7bXtiyZAcaAFyNR9Oqf
MD5:	B473C40205C61DC4750BC49F779908DD
SHA1:	88A0FC0962099F0AC2D827D2C4D691ED9CADE251
SHA-256:	8707C03158BA6395A11BDFD8C1B11EEEDC2E052D3B55D73D0A5C64417E5FBD3B
SHA-512:	8FBAAA5BDE30FE7C6E31A349C14E3BD710E92C4DBCCA8CBDBAF34583887BC31E07E10A0223FC6C6C0D091787C296EBA139EC91AF44EC4EE6ABBFB611493951D1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ................0..$...........C... ...`....@.. ....................................@..................................C..K....`............................................................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc..............................@..B.................C......H........V...v......7........)..............................................(.......(....*.0...........s........~....%:....&~......"...s....%.....(...+o.....8[....o...............%..F~e...(.....%..G~e...(.....%..H~e...(.....%..e~e...(.....~f...(.......o......8......(......s.......sF.......~....}....~...........s....(....o....}......{.....I~e...(....o........9......I~e...(.......8C........~e...(....o....:......{....~g...(....8......{....~h...(.........(...........9........o.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Process:	C:\Users\user\AppData\Roaming\2p4HikHFep.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

WaitForSingleObject, LoadLibraryW, CreateThread, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, CloseHandle, GetCurrentThreadId, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, SetEndOfFile, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, CreateFileW, ReadConsoleW, HeapSize, WriteConsoleW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T01:01:30.159126+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:30.159126+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:30.365180+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	65.21.18.51	45580	192.168.2.6	49712	TCP
2024-09-29T01:01:35.414922+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:35.922404+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:35.927382+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	65.21.18.51	45580	192.168.2.6	49712	TCP
2024-09-29T01:01:36.204197+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:38.635563+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:38.848399+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:39.075145+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:39.309080+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:39.526985+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:39.740338+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:39.948801+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:40.349250+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:40.354537+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:40.631571+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:40.956314+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:41.177133+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:41.439832+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:41.513401+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:41.720483+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:41.927155+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:42.132586+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:42.337332+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:42.544940+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP
2024-09-29T01:01:42.793733+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49712	65.21.18.51	45580	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 01:01:29.406912088 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:29.414182901 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:29.416230917 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:29.425641060 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:29.432833910 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:30.095062017 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:30.142929077 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:30.159126043 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:30.165451050 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:30.365180016 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:30.408520937 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:35.414921999 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:35.420120955 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:35.622122049 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:35.622139931 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:35.622153044 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:35.622164965 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:35.622178078 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:35.622184038 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:35.622245073 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:35.622278929 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:35.922404051 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:35.927381992 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:36.130783081 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:36.174209118 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:36.204196930 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:36.209060907 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:36.410026073 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:36.455478907 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:38.635562897 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:38.641061068 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:38.842802048 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:38.848398924 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:38.855581999 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.059225082 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.075145006 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:39.083317995 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.282284021 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.309079885 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:39.314026117 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.513540983 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.526984930 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:39.532046080 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.732289076 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.740338087 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:39.745279074 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.944636106 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:39.948801041 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:39.955832005 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.155760050 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.205430984 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:40.349250078 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:40.354446888 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354461908 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354484081 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354496002 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354537010 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:40.354573011 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354583025 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354610920 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354620934 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354711056 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.354721069 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.359076023 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.359091997 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.359103918 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.359312057 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.359433889 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.587551117 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.631571054 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:40.636430025 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.835732937 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:40.877280951 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:40.956314087 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:40.961505890 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.160842896 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.177133083 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:41.182010889 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.182023048 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.182033062 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.182142019 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.182173967 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.182183981 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.391231060 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.439831972 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:41.513401031 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:41.518357992 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.718204975 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.720483065 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:41.725698948 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.925117016 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:41.927155018 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:41.932029009 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.131433964 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.132586002 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:42.137415886 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.336760044 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.337332010 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:42.342153072 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.541729927 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.544939995 CEST	49712	45580	192.168.2.6	65.21.18.51
Sep 29, 2024 01:01:42.550035000 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.761431932 CEST	45580	49712	65.21.18.51	192.168.2.6
Sep 29, 2024 01:01:42.793732882 CEST	49712	45580	192.168.2.6	65.21.18.51

Target ID:	0
Start time:	19:01:25
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd90000
File size:	1'030'144 bytes
MD5 hash:	C005D4FFA3E28C22B41A9D222598260A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2121335262.0000000000E09000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2121335262.0000000000DC4000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	19:01:25
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe"
Imagebase:	0xc60000
File size:	501'760 bytes
MD5 hash:	B473C40205C61DC4750BC49F779908DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000000.2119352114.0000000000C62000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\IDVNp0HKaI.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	19:01:25
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	19:01:25
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Roaming\2p4HikHFep.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\2p4HikHFep.exe"
Imagebase:	0x140000
File size:	311'296 bytes
MD5 hash:	65C058E4A90D2EC70B03211D768B6ECC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000000.2120030420.0000000000142000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2282949938.0000000002518000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2282949938.0000000002879000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\2p4HikHFep.exe, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true