Windows Analysis Report
LlDmBISVy0.exe

ID:	1530956
Product:	CloudBasic
Start time:	18:17:08
Start date:	10.10.2024
Sample:	LlDmBISVy0.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b9693b6541a22d01b100b867375279e6
SHA1:	69a65e7a28be4f924f5fdf79ea08f050dac760ac
SHA256:	d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6
Filetype:	Win64 Executable GUI (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256

AV Detection

Source: LlDmBISVy0.exe

Avira: detected

Source: LlDmBISVy0.exe

ReversingLabs: Detection: 55%

Cryptography

Source: C:\Users\user\Desktop\LlDmBISVy0.exe

Code function: 0_2_00007FF755C24690 ?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?copy@QFile@@SA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??0QString@@QEAA@PEBD@Z,?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z,??1QString@@QEAA@XZ,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QSqlDatabase@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlDatabase@@QEAA@XZ,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z,??0QString@@QEAA@PEBD@Z,?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z,??1QString@@QEAA@XZ,?exec@QSqlQuery@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlQuery@@QEAA@XZ,?next@QSqlQuery@@QEAA_NXZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ,??1QVariant@@QEAA@XZ,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?left@QByteArray@@QEHAA?AV1@_J@Z,??1QByteArray@@QEAA@XZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?length@QByteArray@@QEBA_JXZ,EVP_DecryptInit_ex,?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QFile@@QEAA@AEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,memmove,??0QString@@QEAA@$$QEAV0@@Z,??1QString@@QEAA@XZ,??1QSt

0_2_00007FF755C24690

Compliance

Source: LlDmBISVy0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Source: LlDmBISVy0.exe	String found in binary or memory: http://95.164.17.24:1224
Source: LlDmBISVy0.exe	String found in binary or memory: https://hello.freeconference.com/login/access-code
Source: LlDmBISVy0.exe	String found in binary or memory: https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://95.164.17.24:1224

System Summary

Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C24690		0_2_00007FF755C24690
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C269F0		0_2_00007FF755C269F0
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C225C0		0_2_00007FF755C225C0
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C25570		0_2_00007FF755C25570
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C233B0		0_2_00007FF755C233B0
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C22B20		0_2_00007FF755C22B20

Source: LlDmBISVy0.exe	Binary or memory string: OriginalFilename vs LlDmBISVy0.exe
Source: LlDmBISVy0.exe, 00000000.00000002.2937270913.00007FF755C3E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFCCCall.exe0 vs LlDmBISVy0.exe
Source: LlDmBISVy0.exe	Binary or memory string: OriginalFilenameFCCCall.exe0 vs LlDmBISVy0.exe

Source: classification engine

Classification label: mal56.winEXE@1/0@0/0

Source: LlDmBISVy0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LlDmBISVy0.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LlDmBISVy0.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: libcrypto-1_1-x64.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: qt6webenginewidgets.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: qt6widgets.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: qt6webenginecore.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: qt6gui.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: qt6sql.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: qt6network.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: qt6core.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: vcruntime140_1.dll			Jump to behavior
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Section loaded: vcruntime140.dll			Jump to behavior

Source: LlDmBISVy0.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: LlDmBISVy0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: LlDmBISVy0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: LlDmBISVy0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: LlDmBISVy0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LlDmBISVy0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: LlDmBISVy0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: LlDmBISVy0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: LlDmBISVy0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: LlDmBISVy0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LlDmBISVy0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LlDmBISVy0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LlDmBISVy0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LlDmBISVy0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Malware Analysis System Evasion

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging

Source: C:\Users\user\Desktop\LlDmBISVy0.exe

Code function: 0_2_00007FF755C295A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF755C295A8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C295A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF755C295A8
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C29144 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF755C29144
Source: C:\Users\user\Desktop\LlDmBISVy0.exe	Code function: 0_2_00007FF755C2978C SetUnhandledExceptionFilter,		0_2_00007FF755C2978C

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\LlDmBISVy0.exe

Code function: 0_2_00007FF755C297F8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF755C297F8