Windows Analysis Report
TsrKUlTaYJ.exe

Overview

General Information

Sample name: TsrKUlTaYJ.exe
renamed because original name is a hash value
Original sample name: 91f96f2ddfa293806ec3effb8e05bc6941660237de90215b23281d706a2bc706.exe
Analysis ID: 1530952
MD5: f82510d541e56d7021f020f8b4d6a6d0
SHA1: f2c841c297568f7ac24c6277ea8b6fb3dd2a2a46
SHA256: 91f96f2ddfa293806ec3effb8e05bc6941660237de90215b23281d706a2bc706
Tags: 185-235-241-208exeuser-JAMESWT_MHT

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected potential crypto function
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: TsrKUlTaYJ.exe Avira: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C0843C0 ?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?copy@QFile@@SA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??0QString@@QEAA@PEBD@Z,?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z,??1QString@@QEAA@XZ,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QSqlDatabase@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlDatabase@@QEAA@XZ,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z,??0QString@@QEAA@PEBD@Z,?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z,??1QString@@QEAA@XZ,?exec@QSqlQuery@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlQuery@@QEAA@XZ,?next@QSqlQuery@@QEAA_NXZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ,??1QVariant@@QEAA@XZ,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?left@QByteArray@@QEHAA?AV1@_J@Z,??1QByteArray@@QEAA@XZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?length@QByteArray@@QEBA_JXZ,EVP_DecryptInit_ex,?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QFile@@QEAA@AEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,??0QChar@@QEAA@D@Z,?size@QByteArray@@QEBA_JXZ,?isNull@QByteArray@@QEBA_NXZ,?data@QByteArray@@QEBAPEBDXZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QStrin 0_2_00007FF78C0843C0
Source: TsrKUlTaYJ.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: TsrKUlTaYJ.exe String found in binary or memory: http://185.235.241.208:1224
Source: TsrKUlTaYJ.exe String found in binary or memory: https://hello.freeconference.com/login/access-code
Source: TsrKUlTaYJ.exe String found in binary or memory: https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:1
Detected potential crypto function
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C084E90 0_2_00007FF78C084E90
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C082AD0 0_2_00007FF78C082AD0
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C083360 0_2_00007FF78C083360
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C0843C0 0_2_00007FF78C0843C0
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C0864C0 0_2_00007FF78C0864C0
Sample file is different than original file name gathered from version info
Source: TsrKUlTaYJ.exe Binary or memory string: OriginalFilename vs TsrKUlTaYJ.exe
Source: TsrKUlTaYJ.exe, 00000000.00000000.1257613906.00007FF78C09F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameFCCCall.exe0 vs TsrKUlTaYJ.exe
Source: TsrKUlTaYJ.exe Binary or memory string: OriginalFilenameFCCCall.exe0 vs TsrKUlTaYJ.exe
Source: classification engine Classification label: mal48.winEXE@1/0@0/0
Source: TsrKUlTaYJ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: libcrypto-1_1-x64.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: qt6webenginewidgets.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: qt6widgets.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: qt6webenginecore.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: qt6gui.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: qt6sql.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: qt6network.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: qt6core.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Section loaded: vcruntime140.dll Jump to behavior
Source: TsrKUlTaYJ.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: TsrKUlTaYJ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: TsrKUlTaYJ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: TsrKUlTaYJ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: TsrKUlTaYJ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TsrKUlTaYJ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: TsrKUlTaYJ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: TsrKUlTaYJ.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: TsrKUlTaYJ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TsrKUlTaYJ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: TsrKUlTaYJ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: TsrKUlTaYJ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: TsrKUlTaYJ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: TsrKUlTaYJ.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C0890B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF78C0890B4
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C089298 SetUnhandledExceptionFilter, 0_2_00007FF78C089298
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C088C50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF78C088C50
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C0890B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF78C0890B4
Source: C:\Users\user\Desktop\TsrKUlTaYJ.exe Code function: 0_2_00007FF78C089304 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF78C089304
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1530952 Sample: TsrKUlTaYJ.exe Startdate: 10/10/2024 Architecture: WINDOWS Score: 48 7 Antivirus / Scanner detection for submitted sample 2->7 5 TsrKUlTaYJ.exe 2->5         started        process3
⊘No contacted IP infos