Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll
(renamed file extension from exe to dll)
Original sample name:SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.exe
Analysis ID:1521677
MD5:dc5709ae9abe79e00d356e69850d5a3a
SHA1:1ce2d789ef15bbe20ede994924705bdfd19bb9c9
SHA256:06ec5696ffbdc17ef86c2aabd3773e170bf56838c3094adbf880d36567a64915
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 2852 cmdline: loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)
    • conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4136 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • rundll32.exe (PID: 6976 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllReversingLabs: Detection: 21%
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllVirustotal: Detection: 41%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 84.7% probability
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\furkola\Downloads\jar load\jar load\x64\Debug\undergroundjl.pdb)) source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll
Source: Binary string: C:\Users\furkola\Downloads\jar load\jar load\x64\Debug\undergroundjl.pdb source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll
Source: classification engineClassification label: mal52.winDLL@6/0@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3428:120:WilError_03
Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllReversingLabs: Detection: 21%
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllVirustotal: Detection: 41%
Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll"
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: msvcp140d.dllJump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: vcruntime140d.dllJump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: vcruntime140_1d.dllJump to behavior
Source: C:\Windows\System32\loaddll64.exeSection loaded: ucrtbased.dllJump to behavior
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: Image base 0x180000000 > 0x60000000
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\furkola\Downloads\jar load\jar load\x64\Debug\undergroundjl.pdb)) source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll
Source: Binary string: C:\Users\furkola\Downloads\jar load\jar load\x64\Debug\undergroundjl.pdb source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: section name: .textbss
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: section name: .msvcjmc
Source: SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dllStatic PE information: section name: .00cfg
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\loaddll64.exeProcess queried: DebugPortJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1Jump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		11
Process Injection		1
Virtualization/Sandbox Evasion		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Rundll32		LSASS Memory1
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
Process Injection		Security Account Manager1
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1521677 Sample: SecuriteInfo.com.Trojan.Win... Startdate: 29/09/2024 Architecture: WINDOWS Score: 52 15 Multi AV Scanner detection for submitted file 2->15 17 AI detected suspicious sample 2->17 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll21%ReversingLabs
SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll41%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1521677
Start date and time:2024-09-29 02:01:08 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 1m 55s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll
(renamed file extension from exe to dll)
Original Sample Name:SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.exe
Detection:MAL
Classification:mal52.winDLL@6/0@0/0
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Stop behavior analysis, all processes terminated

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):4.577233870503276
TrID:
  • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
  • Win64 Executable (generic) (12005/4) 10.17%
  • Generic Win/DOS Executable (2004/3) 1.70%
  • DOS Executable Generic (2002/1) 1.70%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll
File size:199'680 bytes
MD5:dc5709ae9abe79e00d356e69850d5a3a
SHA1:1ce2d789ef15bbe20ede994924705bdfd19bb9c9
SHA256:06ec5696ffbdc17ef86c2aabd3773e170bf56838c3094adbf880d36567a64915
SHA512:b49e180bb5125e3056ca50f45cff21afc4e6a762443ee6b15aaa11a4ecce85cebebb346421a07bf64dab6349074a445495be5ae40765fbe76cbb8756d6e4e0c5
SSDEEP:3072:wfHKV89cq9zj0GA8SnGN+ONQu7BZ4ch5:wvdcqip2z
TLSH:8814C819B26904B6D1B6C07AA9438367DDB03449133CA5FFA281CAC5BB317DCBA3CB55
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%y..D.F.D.F.D.F...G.D.F...G.D.F...G.D.F...G.D.F.$.G.D.F.<.G.D.F.D.FwD.F...G.D.F...F.D.F...G.D.FRich.D.F................PE..d..

File Icon

Icon Hash:7ae282899bbab082

Static PE Info

General

Entrypoint:0x18001103c
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x180000000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:0x66E83BD1 [Mon Sep 16 14:08:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:0
File Version Major:6
File Version Minor:0
Subsystem Version Major:6
Subsystem Version Minor:0
Import Hash:2c460a57a18f528db035e9aded2388d9

Entrypoint Preview

Instruction
jmp 00007F9770BFABD4h
jmp 00007F9770BFDF7Bh
jmp 00007F9770BFDFD0h
jmp 00007F9770BF98A4h
jmp 00007F9770BFCB00h
jmp 00007F9770BF9942h
jmp 00007F9770BFE05Eh
jmp 00007F9770BF41E1h
jmp 00007F9770BE746Ch
jmp 00007F9770BFDFDDh
jmp 00007F9770BF4701h
jmp 00007F9770BE95CDh
jmp 00007F9770BFB508h
jmp 00007F9770BFDFB1h
jmp 00007F9770BF28BEh
jmp 00007F9770BFDF77h
jmp 00007F9770BE8BD4h
jmp 00007F9770BFDE4Dh
jmp 00007F9770BFBE0Ah
jmp 00007F9770BF9935h
jmp 00007F9770BE7D10h
jmp 00007F9770BF9C6Bh
jmp 00007F9770BE8FB6h
jmp 00007F9770BFC401h
jmp 00007F9770BEC35Ch
jmp 00007F9770BF46DAh
jmp 00007F9770BF4AF2h
jmp 00007F9770BF989Eh
jmp 00007F9770BFDE4Ch
jmp 00007F9770BFB833h
jmp 00007F9770BFDE9Ch
jmp 00007F9770BFC649h
jmp 00007F9770BF97F5h
jmp 00007F9770BEB0BFh
jmp 00007F9770BEAB2Ah
jmp 00007F9770BF9840h
jmp 00007F9770BF3760h
jmp 00007F9770BEFE8Bh
jmp 00007F9770BECD56h
jmp 00007F9770BED4A1h

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x409b80xb4.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000x326.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x3c0000x2eec.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x470000x1ec.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x353f00x38.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x352700x140.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x400000x9b8.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.textbss0x10000x100000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text0x110000x1fd6b0x1fe004be202b2441bebe331215a74b457e123False0.25777420343137253data4.491302909125051IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x310000x85440x8600799a84373f010b74b4cd2e419a26a2e0False0.18790811567164178DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 2543193068206903102245888327680.0000003.0395969394620272IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x3a0000x13a00xc0014e0fc9d852e53af86dae5f0ca9fe1c6False0.2666015625data3.444740350271675IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata0x3c0000x34c80x360021a27195e539538b9886d5604cbc77f0False0.2306857638888889data2.895326784781595IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata0x400000x309a0x32007c240af318e1eaa697e7f374e5953355False0.22609375data4.2786785593808965IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.msvcjmc0x440000x3a60x400f845e4e2aa322785f9d5cf66b393d480False0.02734375Targa image data - Map (257-257) 257 x 257 x 1 +257 +257 - 1-bit alpha "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001"0.9922565478487513IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg0x450000x1750x2005c6622558a7de0348692359354d4dba6False0.0703125OpenPGP Secret Key0.47941018539878455IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc0x460000x3260x400add4a5d11dea653fcfdc4c4c06b8d6c6False0.171875data1.4379588981308504IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0x470000x56a0x6006fbe12de591231ff76f79538bd8b4b72False0.2532552083333333data2.3913828446357734IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountryZLIB Complexity
RT_MANIFEST0x461700x91XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.8689655172413793

Imports

DLLImport
KERNEL32.dllCloseHandle, OpenProcess, ReadProcessMemory, WriteProcessMemory, K32EnumProcessModulesEx, K32GetModuleBaseNameA, K32GetModuleFileNameExA, K32GetModuleInformation, VirtualProtect, DisableThreadLibraryCalls, GetModuleHandleA, GetProcAddress, GetProcessHeap, GetLastError, GetStartupInfoW, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, WideCharToMultiByte, MultiByteToWideChar, RaiseException, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetSystemInfo, VirtualQuery, VirtualFree, VirtualAlloc, Thread32Next, Thread32First, CreateToolhelp32Snapshot, GetModuleHandleW, Sleep, ResumeThread, SuspendThread, SetThreadContext, GetThreadContext, OpenThread, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, HeapCreate, FlushInstructionCache, FreeLibrary
USER32.dllGetWindowThreadProcessId, SetWindowTextA, FindWindowA
MSVCP140D.dll?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ, ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ??0_Lockit@std@@QEAA@H@Z, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?width@ios_base@std@@QEAA_J_J@Z, ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?width@ios_base@std@@QEBA_JXZ, ??1_Lockit@std@@QEAA@XZ, ?setf@ios_base@std@@QEAAHHH@Z, ?flags@ios_base@std@@QEBAHXZ, ?good@ios_base@std@@QEBA_NXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ??Bid@locale@std@@QEAA_KXZ, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_alloc@std@@YAXXZ, ?_Xlength_error@std@@YAXPEBD@Z, ?_Xout_of_range@std@@YAXPEBD@Z, _Mbrtowc, ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ, ?_Getdays@_Locinfo@std@@QEBAPEBDXZ, ?_Getmonths@_Locinfo@std@@QEBAPEBDXZ, ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ, ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
ntdll.dllRtlLookupFunctionEntry, RtlVirtualUnwind, RtlCaptureContext
dbghelp.dllImageNtHeader
VCRUNTIME140D.dll__current_exception, __std_type_info_destroy_list, __C_specific_handler_noexcept, __C_specific_handler, __vcrt_GetModuleFileNameW, memchr, _CxxThrowException, __std_exception_copy, memcpy, memcmp, __current_exception_context, __std_exception_destroy, __vcrt_GetModuleHandleW, memset, __vcrt_LoadLibraryExW, memmove
VCRUNTIME140_1D.dll__CxxFrameHandler4
ucrtbased.dll_crt_at_quick_exit, _cexit, terminate, _wmakepath_s, _wsplitpath_s, wcscpy_s, _execute_onexit_table, strcpy_s, _initterm_e, _initterm, _CrtDbgReportW, malloc, _callnewh, _malloc_dbg, _free_dbg, isalnum, _register_onexit_function, _lock_file, ungetc, setvbuf, fwrite, _fseeki64, fsetpos, fread, fputc, fgetc, fflush, fclose, _get_stream_buffer_pointers, _CrtDbgReport, _calloc_dbg, strlen, strcmp, wcslen, _invalid_parameter, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _seh_filter_dll, __stdio_common_vsprintf_s, _crt_atexit, _unlock_file, strcat_s, fgetpos

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:20:02:09
Start date:28/09/2024
Path:C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):false
Commandline:loaddll64.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll"
Imagebase:0x7ff627200000
File size:165'888 bytes
MD5 hash:763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:1
Start time:20:02:09
Start date:28/09/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6ee680000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:2
Start time:20:02:09
Start date:28/09/2024
Path:C:\Windows\System32\cmd.exe
Wow64 process (32bit):false
Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1
Imagebase:0x7ff7d9250000
File size:289'792 bytes
MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:4
Start time:20:02:09
Start date:28/09/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Krypt.28688.30024.dll",#1
Imagebase:0x7ff6a0d10000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Disassembly

⊘No disassembly