Source: 7R4CQlalZQ.exe |
Malware Configuration Extractor: Xworm {"C2 url": ["193.233.255.34"], "Port": "7777", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"} |
Source: 193.233.255.34 |
Virustotal: Detection: 10% |
Perma Link |
Source: 7R4CQlalZQ.exe |
ReversingLabs: Detection: 84% |
Source: 7R4CQlalZQ.exe |
Virustotal: Detection: 84% |
Perma Link |
Source: Submited Sample |
Integrated Neural Analysis Model: Matched 100.0% probability |
Source: 7R4CQlalZQ.exe |
String decryptor: 193.233.255.34 |
Source: 7R4CQlalZQ.exe |
String decryptor: 7777 |
Source: 7R4CQlalZQ.exe |
String decryptor: <123456789> |
Source: 7R4CQlalZQ.exe |
String decryptor: <Xwormmm> |
Source: 7R4CQlalZQ.exe |
String decryptor: XWorm V5.6 |
Source: 7R4CQlalZQ.exe |
String decryptor: USB.exe |
Source: 7R4CQlalZQ.exe |
Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE |
Source: 7R4CQlalZQ.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: Network traffic |
Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 193.233.255.34:7777 -> 192.168.2.5:49704 |
Source: Network traffic |
Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 193.233.255.34:7777 -> 192.168.2.5:49704 |
Source: Network traffic |
Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49704 -> 193.233.255.34:7777 |
Source: Network traffic |
Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:49704 -> 193.233.255.34:7777 |
Source: Network traffic |
Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49704 -> 193.233.255.34:7777 |
Source: Malware configuration extractor |
URLs: 193.233.255.34 |
Source: global traffic |
TCP traffic: 192.168.2.5:49704 -> 193.233.255.34:7777 |
Source: Joe Sandbox View |
ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 193.233.255.34 |
Source: 7R4CQlalZQ.exe, 00000000.00000002.4473608213.0000000003241000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: 7R4CQlalZQ.exe, type: SAMPLE |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 0.0.7R4CQlalZQ.exe.d30000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 00000000.00000000.2025480520.0000000000D32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process Stats: CPU usage > 49% |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Code function: 0_2_00007FF848E85D76 |
0_2_00007FF848E85D76 |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Code function: 0_2_00007FF848E86B22 |
0_2_00007FF848E86B22 |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Code function: 0_2_00007FF848E896B4 |
0_2_00007FF848E896B4 |
Source: 7R4CQlalZQ.exe, 00000000.00000000.2025480520.0000000000D32000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenameXClient.exe4 vs 7R4CQlalZQ.exe |
Source: 7R4CQlalZQ.exe |
Binary or memory string: OriginalFilenameXClient.exe4 vs 7R4CQlalZQ.exe |
Source: 7R4CQlalZQ.exe |
Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE |
Source: 7R4CQlalZQ.exe, type: SAMPLE |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0.0.7R4CQlalZQ.exe.d30000.0.unpack, type: UNPACKEDPE |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 00000000.00000000.2025480520.0000000000D32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 7R4CQlalZQ.exe, Helper.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 7R4CQlalZQ.exe, Helper.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 7R4CQlalZQ.exe, AlgorithmAES.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: classification engine |
Classification label: mal100.troj.evad.winEXE@1/0@0/1 |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Mutant created: NULL |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Mutant created: \Sessions\1\BaseNamedObjects\RPVmSS9pizbP4j38 |
Source: 7R4CQlalZQ.exe |
Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: 7R4CQlalZQ.exe |
Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80% |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: 7R4CQlalZQ.exe |
ReversingLabs: Detection: 84% |
Source: 7R4CQlalZQ.exe |
Virustotal: Detection: 84% |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: avicap32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: msvfw32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 |
Jump to behavior |
Source: 7R4CQlalZQ.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR |
Source: 7R4CQlalZQ.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: 7R4CQlalZQ.exe, Messages.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true) |
Source: 7R4CQlalZQ.exe, Messages.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true) |
Source: 7R4CQlalZQ.exe, Messages.cs |
.Net Code: Plugin System.AppDomain.Load(byte[]) |
Source: 7R4CQlalZQ.exe, Messages.cs |
.Net Code: Memory System.AppDomain.Load(byte[]) |
Source: 7R4CQlalZQ.exe, Messages.cs |
.Net Code: Memory |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Code function: 0_2_00007FF848E87558 push ebx; iretd |
0_2_00007FF848E8756A |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Code function: 0_2_00007FF848E87548 push ebx; iretd |
0_2_00007FF848E8756A |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Code function: 0_2_00007FF848E87538 push ebx; iretd |
0_2_00007FF848E8756A |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Code function: 0_2_00007FF848E87528 push ebx; iretd |
0_2_00007FF848E8756A |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Memory allocated: 1270000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Memory allocated: 1B240000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Window / User API: threadDelayed 9296 |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Window / User API: threadDelayed 553 |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe TID: 3040 |
Thread sleep time: -2767011611056431s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe TID: 728 |
Thread sleep count: 9296 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe TID: 728 |
Thread sleep count: 553 > 30 |
Jump to behavior |
Source: all processes |
Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
File Volume queried: C:\ FullSizeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
File Volume queried: C:\ FullSizeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: 7R4CQlalZQ.exe, 00000000.00000002.4472043958.000000000133F000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3 |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process Stats: CPU usage > 42% for more than 60s |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Process token adjusted: Debug |
Jump to behavior |
Source: all processes |
Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Memory allocated: page read and write | page guard |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Queries volume information: C:\Users\user\Desktop\7R4CQlalZQ.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Jump to behavior |
Source: 7R4CQlalZQ.exe, 00000000.00000002.4475004158.000000001BFA0000.00000004.00000020.00020000.00000000.sdmp, 7R4CQlalZQ.exe, 00000000.00000002.4475004158.000000001BFCD000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe |
Source: C:\Users\user\Desktop\7R4CQlalZQ.exe |
WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct |
Source: Yara match |
File source: 7R4CQlalZQ.exe, type: SAMPLE |
Source: Yara match |
File source: 0.0.7R4CQlalZQ.exe.d30000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000000.2025480520.0000000000D32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4473608213.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: 7R4CQlalZQ.exe PID: 2828, type: MEMORYSTR |
Source: Yara match |
File source: 7R4CQlalZQ.exe, type: SAMPLE |
Source: Yara match |
File source: 0.0.7R4CQlalZQ.exe.d30000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000000.2025480520.0000000000D32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.4473608213.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: 7R4CQlalZQ.exe PID: 2828, type: MEMORYSTR |