Windows Analysis Report
loader.exe

Overview

General Information

Sample name: loader.exe
Analysis ID: 1525820
MD5: b750903ba5abb6ee7528aad139ec6404
SHA1: 9a6107f86b044d6783a202c3f16310d2ca60f149
SHA256: 11f98be1f2418783aec952a9814bbe8c26010554c2662671ab4b18f7e425b4b6
Tags: exeuser-aachum
Infos:

Detection

RedLine
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
.NET source code contains very large array initializations
AI detected suspicious sample
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Detected potential crypto function
Enables debug privileges
Enables security privileges
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: loader.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: loader.exe ReversingLabs: Detection: 68%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: loader.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: loader.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: _.pdb source: loader.exe, 00000000.00000003.1486292327.000000000081B000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000000.00000002.1506599549.0000000002370000.00000004.08000000.00040000.00000000.sdmp, loader.exe, 00000000.00000002.1506666108.00000000023E6000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000000.00000002.1509937450.0000000003991000.00000004.00000800.00020000.00000000.sdmp
Source: loader.exe, 00000000.00000002.1507826756.0000000002991000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: loader.exe, 00000000.00000002.1507826756.0000000002991000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)
Source: loader.exe, 00000000.00000002.1507826756.0000000002991000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`, equals www.youtube.com (Youtube)
Source: loader.exe, 00000000.00000002.1507826756.0000000002991000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: loader.exe, 00000000.00000002.1507826756.0000000002991000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)
Source: loader.exe, 00000000.00000002.1507826756.0000000002991000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.s
Source: loader.exe, 00000000.00000002.1507826756.0000000002991000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: loader.exe, 00000000.00000002.1507826756.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Installs a raw input device (often for capturing keystrokes)
Source: loader.exe, 00000000.00000002.1507826756.0000000002C05000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_b8ae76c6-a

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: loader.exe, type: SAMPLE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects RedLine infostealer Author: ditekSHen
.NET source code contains very large array initializations
Source: 0.3.loader.exe.81b900.0.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Large array initialization: R3D7rEdzqGVdFfcfcJ6: array initializer size 6160
Source: 0.2.loader.exe.2730000.5.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Large array initialization: R3D7rEdzqGVdFfcfcJ6: array initializer size 6160
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Large array initialization: R3D7rEdzqGVdFfcfcJ6: array initializer size 6160
Source: 0.2.loader.exe.3996458.6.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Large array initialization: R3D7rEdzqGVdFfcfcJ6: array initializer size 6160
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Large array initialization: R3D7rEdzqGVdFfcfcJ6: array initializer size 6160
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Large array initialization: R3D7rEdzqGVdFfcfcJ6: array initializer size 6160
Detected potential crypto function
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00408C60 0_2_00408C60
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0040DC11 0_2_0040DC11
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00407C3F 0_2_00407C3F
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00418CCC 0_2_00418CCC
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00406CA0 0_2_00406CA0
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004028B0 0_2_004028B0
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0041A4BE 0_2_0041A4BE
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00418244 0_2_00418244
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00401650 0_2_00401650
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00402F20 0_2_00402F20
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004193C4 0_2_004193C4
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00418788 0_2_00418788
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00402F89 0_2_00402F89
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00402B90 0_2_00402B90
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004073A0 0_2_004073A0
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_022EE17C 0_2_022EE17C
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_027B01D8 0_2_027B01D8
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_027B01C8 0_2_027B01C8
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0291D3B0 0_2_0291D3B0
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0291CE88 0_2_0291CE88
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_069E04D0 0_2_069E04D0
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_069E6C23 0_2_069E6C23
Enables security privileges
Source: C:\Users\user\Desktop\loader.exe Process token adjusted: Security Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\loader.exe Code function: String function: 0040E1D8 appears 43 times
Sample file is different than original file name gathered from version info
Source: loader.exe, 00000000.00000003.1486292327.000000000081B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Source: loader.exe, 00000000.00000003.1486292327.000000000081B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs loader.exe
Source: loader.exe, 00000000.00000002.1506599549.0000000002370000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Source: loader.exe, 00000000.00000002.1506599549.0000000002370000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs loader.exe
Source: loader.exe, 00000000.00000003.1486292327.00000000008AA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Source: loader.exe, 00000000.00000002.1506666108.00000000023E6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Source: loader.exe, 00000000.00000002.1506666108.00000000023E6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs loader.exe
Source: loader.exe, 00000000.00000003.1485913497.000000000089C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs loader.exe
Source: loader.exe, 00000000.00000002.1505310948.000000000045C000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Source: loader.exe, 00000000.00000002.1507423486.0000000002730000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Source: loader.exe, 00000000.00000003.1485860221.000000000088D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs loader.exe
Source: loader.exe, 00000000.00000002.1509937450.0000000003991000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Source: loader.exe, 00000000.00000002.1509937450.0000000003991000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename_.dll4 vs loader.exe
Source: loader.exe Binary or memory string: OriginalFilenameSunroom.exe" vs loader.exe
Uses 32bit PE files
Source: loader.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Yara signature match
Source: loader.exe, type: SAMPLE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.loader.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: loader.exe Static PE information: Section: .rsrc ZLIB complexity 0.9936445223112128
Source: 0.3.loader.exe.81b900.0.raw.unpack, rcfyuyTzwAVvRrBPRJL.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.loader.exe.81b900.0.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.loader.exe.2730000.5.raw.unpack, rcfyuyTzwAVvRrBPRJL.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.loader.exe.2730000.5.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, rcfyuyTzwAVvRrBPRJL.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.loader.exe.3996458.6.raw.unpack, rcfyuyTzwAVvRrBPRJL.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.loader.exe.3996458.6.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, rcfyuyTzwAVvRrBPRJL.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, rcfyuyTzwAVvRrBPRJL.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.loader.exe.81b900.0.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Base64 encoded string: 'NQQ5Cy4TBwAnFDw2FjQBJSEwSjsYXUY4Iz4LGiIvJCshJz9nOysfTBk4HxkgATkJIT4OOyUkDTsNCUNE'
Source: 0.2.loader.exe.2730000.5.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Base64 encoded string: 'NQQ5Cy4TBwAnFDw2FjQBJSEwSjsYXUY4Iz4LGiIvJCshJz9nOysfTBk4HxkgATkJIT4OOyUkDTsNCUNE'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Base64 encoded string: 'NQQ5Cy4TBwAnFDw2FjQBJSEwSjsYXUY4Iz4LGiIvJCshJz9nOysfTBk4HxkgATkJIT4OOyUkDTsNCUNE'
Source: 0.2.loader.exe.3996458.6.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Base64 encoded string: 'NQQ5Cy4TBwAnFDw2FjQBJSEwSjsYXUY4Iz4LGiIvJCshJz9nOysfTBk4HxkgATkJIT4OOyUkDTsNCUNE'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Base64 encoded string: 'NQQ5Cy4TBwAnFDw2FjQBJSEwSjsYXUY4Iz4LGiIvJCshJz9nOysfTBk4HxkgATkJIT4OOyUkDTsNCUNE'
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, R3D7rEdzqGVdFfcfcJ6.cs Base64 encoded string: 'NQQ5Cy4TBwAnFDw2FjQBJSEwSjsYXUY4Iz4LGiIvJCshJz9nOysfTBk4HxkgATkJIT4OOyUkDTsNCUNE'
Source: classification engine Classification label: mal88.troj.evad.winEXE@2/1@0/0
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Source: C:\Users\user\Desktop\loader.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\loader.exe.log Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:824:120:WilError_03
Source: C:\Users\user\Desktop\loader.exe Command line argument: 08A 0_2_00413780
Source: loader.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\loader.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: loader.exe ReversingLabs: Detection: 68%
Source: unknown Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\loader.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: loader.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: _.pdb source: loader.exe, 00000000.00000003.1486292327.000000000081B000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000000.00000002.1506599549.0000000002370000.00000004.08000000.00040000.00000000.sdmp, loader.exe, 00000000.00000002.1506666108.00000000023E6000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000000.00000002.1509937450.0000000003991000.00000004.00000800.00020000.00000000.sdmp
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
PE file contains an invalid checksum
Source: loader.exe Static PE information: real checksum: 0x23bfb should be: 0x5e6f5
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0040E21D push ecx; ret 0_2_0040E230
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_027B9A60 push esp; iretd 0_2_027B9A61
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_069E900D push FFFFFF8Bh; iretd 0_2_069E900F
Source: 0.3.loader.exe.81b900.0.raw.unpack, pV6W58JtYEixu9F3IDb.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'G7Hn8sA5yr', 'mdCJcYCmWJ', 'lxKJgTVIr9', 'TmeJQCwAIf', 'wNsJvuMlem', 'JdjJ0yfWaK', 'HTWOMU5HZG', 'ChUn3VFYXt', 'Y1rn7CeXec'
Source: 0.3.loader.exe.81b900.0.raw.unpack, sjGxSN2D3DSb9ZRckQw.cs High entropy of concatenated method names: 'ShowMessage', 'Yfp26y1pZ3', 'U5q2ZcjaFm', 'Ae12PWjUH0', 'gpT2KgrniZ', 'sXL2M1QRIf', 'Vhq2j06REx', 'zIu2zqwkQv', 'qQR83p3aHE', 'wZ48Wmh9Kf'
Source: 0.3.loader.exe.81b900.0.raw.unpack, uvKl4jd2pdrDKv5i801.cs High entropy of concatenated method names: 'mGgd7gOw5e', 'ISwd55nMya', 'VnrdT5iOGo', 'ctGd1h4D41', 'LQtdxnO6bt', 'jGAdpMLYLa', 'vpndCOuAlZ', 'N3kdX97FHp', 'iJSdOgxSZL', 'J7jdnZEpUl'
Source: 0.3.loader.exe.81b900.0.raw.unpack, qYt2UGWxomMCcArni6L.cs High entropy of concatenated method names: 'ABHWU0Q5M7', 'subWt2bppy', 'G8pWckTVZR', 'D5GWge2ebs', 'CMTWCfyMjj', 'CfTWXYoR3u', 'V63WOENucu', 'y8RWng56rs', 'dUWWb7psyB', 'tJjWN5IVnM'
Source: 0.3.loader.exe.81b900.0.raw.unpack, ImLCtHJpB7Y34H2qdnG.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'ChUn3VFYXt', 'HTWOMU5HZG', 'bRUnWXH8lY', 'olQnLg4V9M', 'ojUni3EWO6', 'F5gnJo62vD', 'YS1nql2bUi', 'YBiJXVq2wc', 'w39ndGQkM9'
Source: 0.2.loader.exe.2730000.5.raw.unpack, pV6W58JtYEixu9F3IDb.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'G7Hn8sA5yr', 'mdCJcYCmWJ', 'lxKJgTVIr9', 'TmeJQCwAIf', 'wNsJvuMlem', 'JdjJ0yfWaK', 'HTWOMU5HZG', 'ChUn3VFYXt', 'Y1rn7CeXec'
Source: 0.2.loader.exe.2730000.5.raw.unpack, sjGxSN2D3DSb9ZRckQw.cs High entropy of concatenated method names: 'ShowMessage', 'Yfp26y1pZ3', 'U5q2ZcjaFm', 'Ae12PWjUH0', 'gpT2KgrniZ', 'sXL2M1QRIf', 'Vhq2j06REx', 'zIu2zqwkQv', 'qQR83p3aHE', 'wZ48Wmh9Kf'
Source: 0.2.loader.exe.2730000.5.raw.unpack, uvKl4jd2pdrDKv5i801.cs High entropy of concatenated method names: 'mGgd7gOw5e', 'ISwd55nMya', 'VnrdT5iOGo', 'ctGd1h4D41', 'LQtdxnO6bt', 'jGAdpMLYLa', 'vpndCOuAlZ', 'N3kdX97FHp', 'iJSdOgxSZL', 'J7jdnZEpUl'
Source: 0.2.loader.exe.2730000.5.raw.unpack, qYt2UGWxomMCcArni6L.cs High entropy of concatenated method names: 'ABHWU0Q5M7', 'subWt2bppy', 'G8pWckTVZR', 'D5GWge2ebs', 'CMTWCfyMjj', 'CfTWXYoR3u', 'V63WOENucu', 'y8RWng56rs', 'dUWWb7psyB', 'tJjWN5IVnM'
Source: 0.2.loader.exe.2730000.5.raw.unpack, ImLCtHJpB7Y34H2qdnG.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'ChUn3VFYXt', 'HTWOMU5HZG', 'bRUnWXH8lY', 'olQnLg4V9M', 'ojUni3EWO6', 'F5gnJo62vD', 'YS1nql2bUi', 'YBiJXVq2wc', 'w39ndGQkM9'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, pV6W58JtYEixu9F3IDb.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'G7Hn8sA5yr', 'mdCJcYCmWJ', 'lxKJgTVIr9', 'TmeJQCwAIf', 'wNsJvuMlem', 'JdjJ0yfWaK', 'HTWOMU5HZG', 'ChUn3VFYXt', 'Y1rn7CeXec'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, sjGxSN2D3DSb9ZRckQw.cs High entropy of concatenated method names: 'ShowMessage', 'Yfp26y1pZ3', 'U5q2ZcjaFm', 'Ae12PWjUH0', 'gpT2KgrniZ', 'sXL2M1QRIf', 'Vhq2j06REx', 'zIu2zqwkQv', 'qQR83p3aHE', 'wZ48Wmh9Kf'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, uvKl4jd2pdrDKv5i801.cs High entropy of concatenated method names: 'mGgd7gOw5e', 'ISwd55nMya', 'VnrdT5iOGo', 'ctGd1h4D41', 'LQtdxnO6bt', 'jGAdpMLYLa', 'vpndCOuAlZ', 'N3kdX97FHp', 'iJSdOgxSZL', 'J7jdnZEpUl'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, qYt2UGWxomMCcArni6L.cs High entropy of concatenated method names: 'ABHWU0Q5M7', 'subWt2bppy', 'G8pWckTVZR', 'D5GWge2ebs', 'CMTWCfyMjj', 'CfTWXYoR3u', 'V63WOENucu', 'y8RWng56rs', 'dUWWb7psyB', 'tJjWN5IVnM'
Source: 0.2.loader.exe.2370ee8.2.raw.unpack, ImLCtHJpB7Y34H2qdnG.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'ChUn3VFYXt', 'HTWOMU5HZG', 'bRUnWXH8lY', 'olQnLg4V9M', 'ojUni3EWO6', 'F5gnJo62vD', 'YS1nql2bUi', 'YBiJXVq2wc', 'w39ndGQkM9'
Source: 0.2.loader.exe.3996458.6.raw.unpack, pV6W58JtYEixu9F3IDb.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'G7Hn8sA5yr', 'mdCJcYCmWJ', 'lxKJgTVIr9', 'TmeJQCwAIf', 'wNsJvuMlem', 'JdjJ0yfWaK', 'HTWOMU5HZG', 'ChUn3VFYXt', 'Y1rn7CeXec'
Source: 0.2.loader.exe.3996458.6.raw.unpack, sjGxSN2D3DSb9ZRckQw.cs High entropy of concatenated method names: 'ShowMessage', 'Yfp26y1pZ3', 'U5q2ZcjaFm', 'Ae12PWjUH0', 'gpT2KgrniZ', 'sXL2M1QRIf', 'Vhq2j06REx', 'zIu2zqwkQv', 'qQR83p3aHE', 'wZ48Wmh9Kf'
Source: 0.2.loader.exe.3996458.6.raw.unpack, uvKl4jd2pdrDKv5i801.cs High entropy of concatenated method names: 'mGgd7gOw5e', 'ISwd55nMya', 'VnrdT5iOGo', 'ctGd1h4D41', 'LQtdxnO6bt', 'jGAdpMLYLa', 'vpndCOuAlZ', 'N3kdX97FHp', 'iJSdOgxSZL', 'J7jdnZEpUl'
Source: 0.2.loader.exe.3996458.6.raw.unpack, qYt2UGWxomMCcArni6L.cs High entropy of concatenated method names: 'ABHWU0Q5M7', 'subWt2bppy', 'G8pWckTVZR', 'D5GWge2ebs', 'CMTWCfyMjj', 'CfTWXYoR3u', 'V63WOENucu', 'y8RWng56rs', 'dUWWb7psyB', 'tJjWN5IVnM'
Source: 0.2.loader.exe.3996458.6.raw.unpack, ImLCtHJpB7Y34H2qdnG.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'ChUn3VFYXt', 'HTWOMU5HZG', 'bRUnWXH8lY', 'olQnLg4V9M', 'ojUni3EWO6', 'F5gnJo62vD', 'YS1nql2bUi', 'YBiJXVq2wc', 'w39ndGQkM9'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, pV6W58JtYEixu9F3IDb.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'G7Hn8sA5yr', 'mdCJcYCmWJ', 'lxKJgTVIr9', 'TmeJQCwAIf', 'wNsJvuMlem', 'JdjJ0yfWaK', 'HTWOMU5HZG', 'ChUn3VFYXt', 'Y1rn7CeXec'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, sjGxSN2D3DSb9ZRckQw.cs High entropy of concatenated method names: 'ShowMessage', 'Yfp26y1pZ3', 'U5q2ZcjaFm', 'Ae12PWjUH0', 'gpT2KgrniZ', 'sXL2M1QRIf', 'Vhq2j06REx', 'zIu2zqwkQv', 'qQR83p3aHE', 'wZ48Wmh9Kf'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, uvKl4jd2pdrDKv5i801.cs High entropy of concatenated method names: 'mGgd7gOw5e', 'ISwd55nMya', 'VnrdT5iOGo', 'ctGd1h4D41', 'LQtdxnO6bt', 'jGAdpMLYLa', 'vpndCOuAlZ', 'N3kdX97FHp', 'iJSdOgxSZL', 'J7jdnZEpUl'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, qYt2UGWxomMCcArni6L.cs High entropy of concatenated method names: 'ABHWU0Q5M7', 'subWt2bppy', 'G8pWckTVZR', 'D5GWge2ebs', 'CMTWCfyMjj', 'CfTWXYoR3u', 'V63WOENucu', 'y8RWng56rs', 'dUWWb7psyB', 'tJjWN5IVnM'
Source: 0.2.loader.exe.39d2d90.8.raw.unpack, ImLCtHJpB7Y34H2qdnG.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'ChUn3VFYXt', 'HTWOMU5HZG', 'bRUnWXH8lY', 'olQnLg4V9M', 'ojUni3EWO6', 'F5gnJo62vD', 'YS1nql2bUi', 'YBiJXVq2wc', 'w39ndGQkM9'
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, pV6W58JtYEixu9F3IDb.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'G7Hn8sA5yr', 'mdCJcYCmWJ', 'lxKJgTVIr9', 'TmeJQCwAIf', 'wNsJvuMlem', 'JdjJ0yfWaK', 'HTWOMU5HZG', 'ChUn3VFYXt', 'Y1rn7CeXec'
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, sjGxSN2D3DSb9ZRckQw.cs High entropy of concatenated method names: 'ShowMessage', 'Yfp26y1pZ3', 'U5q2ZcjaFm', 'Ae12PWjUH0', 'gpT2KgrniZ', 'sXL2M1QRIf', 'Vhq2j06REx', 'zIu2zqwkQv', 'qQR83p3aHE', 'wZ48Wmh9Kf'
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, uvKl4jd2pdrDKv5i801.cs High entropy of concatenated method names: 'mGgd7gOw5e', 'ISwd55nMya', 'VnrdT5iOGo', 'ctGd1h4D41', 'LQtdxnO6bt', 'jGAdpMLYLa', 'vpndCOuAlZ', 'N3kdX97FHp', 'iJSdOgxSZL', 'J7jdnZEpUl'
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, qYt2UGWxomMCcArni6L.cs High entropy of concatenated method names: 'ABHWU0Q5M7', 'subWt2bppy', 'G8pWckTVZR', 'D5GWge2ebs', 'CMTWCfyMjj', 'CfTWXYoR3u', 'V63WOENucu', 'y8RWng56rs', 'dUWWb7psyB', 'tJjWN5IVnM'
Source: 0.2.loader.exe.2427ee6.3.raw.unpack, ImLCtHJpB7Y34H2qdnG.cs High entropy of concatenated method names: 'QnAOzlNEKs', 'ChUn3VFYXt', 'HTWOMU5HZG', 'bRUnWXH8lY', 'olQnLg4V9M', 'ojUni3EWO6', 'F5gnJo62vD', 'YS1nql2bUi', 'YBiJXVq2wc', 'w39ndGQkM9'
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: loader.exe, 00000000.00000002.1507826756.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE`,
Source: loader.exe, 00000000.00000002.1507826756.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE
Source: loader.exe, 00000000.00000002.1507826756.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE@\
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\loader.exe Memory allocated: 22A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Memory allocated: 2990000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Memory allocated: 2690000 memory reserve | memory write watch Jump to behavior
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\loader.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\Desktop\loader.exe Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\loader.exe TID: 6668 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: loader.exe, 00000000.00000002.1507826756.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe
Source: loader.exe, 00000000.00000002.1507826756.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe`,
Source: loader.exe, 00000000.00000002.1507826756.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe@\
Source: C:\Users\user\Desktop\loader.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0040CE09
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear, 0_2_004019F0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree, 0_2_0040ADB0
Enables debug privileges
Source: C:\Users\user\Desktop\loader.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0040CE09
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0040E61C
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_004123F1 SetUnhandledExceptionFilter, 0_2_004123F1
Source: C:\Users\user\Desktop\loader.exe Memory allocated: page read and write | page guard Jump to behavior
Source: loader.exe, 00000000.00000002.1507826756.0000000002C05000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetProgmanWindow
Source: loader.exe, 00000000.00000002.1507826756.0000000002C05000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SetProgmanWindow
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\loader.exe Code function: GetLocaleInfoA, 0_2_00417A20
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\loader.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\loader.exe Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_00412A15
Source: C:\Users\user\Desktop\loader.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: Process Memory Space: loader.exe PID: 4928, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: Process Memory Space: loader.exe PID: 4928, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1525820 Sample: loader.exe Startdate: 04/10/2024 Architecture: WINDOWS Score: 88 14 Malicious sample detected (through community Yara rule) 2->14 16 Antivirus / Scanner detection for submitted sample 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 4 other signatures 2->20 6 loader.exe 4 2->6         started        process3 file4 12 C:\Users\user\AppData\...\loader.exe.log, ASCII 6->12 dropped 22 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 6->22 10 conhost.exe 6->10         started        signatures5 process6
⊘No contacted IP infos