Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Malware-gen.324.4623.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win64.Malware-gen.324.4623.exe
Analysis ID:1532115
MD5:eaa5207750d5fc8204170ec6bda64cca
SHA1:34828c5aa252a5e83127d1185edcee869f611567
SHA256:1ed69b65f453f2f8363a8988d0b069c66c045cc28232dfd2935dddbd9fcfe011
Tags:exe
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
PE file contains sections with non-standard names
Potential time zone aware malware
Program does not show much activity (idle)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win64.Malware-gen.324.4623.exe (PID: 5312 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exe" MD5: EAA5207750D5FC8204170EC6BDA64CCA)
    • conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeReversingLabs: Detection: 45%
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeVirustotal: Detection: 25%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 97.8% probability
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: classification engineClassification label: mal60.winEXE@2/0@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeFile opened: C:\Windows\system32\28501ae350293497c738636705a7a44473f465a663f2f99209fc78cd0d15cf63AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJump to behavior
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeReversingLabs: Detection: 45%
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeVirustotal: Detection: 25%
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeSection loaded: umpdc.dllJump to behavior
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic file information: File size 5777920 > 1048576
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x2a1600
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x27c200
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exeStatic PE information: section name: .symtab
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exeSystem information queried: CurrentTimeZoneInformationJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: SecuriteInfo.com.Win64.Malware-gen.324.4623.exe, 00000000.00000002.2195510150.00000223168CC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Process Injection		OS Credential Dumping1
System Time Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
DLL Side-Loading		LSASS Memory1
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Win64.Malware-gen.324.4623.exe46%ReversingLabsWin64.Adware.RedCap
SecuriteInfo.com.Win64.Malware-gen.324.4623.exe25%VirustotalBrowse
SecuriteInfo.com.Win64.Malware-gen.324.4623.exe100%AviraTR/Redcap.grmhl

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
fp2e7a.wpc.phicdn.net0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
fp2e7a.wpc.phicdn.net
192.229.221.95
truefalseunknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1532115
Start date and time:2024-10-12 12:39:11 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 2m 39s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:4
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:SecuriteInfo.com.Win64.Malware-gen.324.4623.exe
Detection:MAL
Classification:mal60.winEXE@2/0@0/0
EGA Information:Failed
HCA Information:Failed
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
  • Excluded IPs from analysis (whitelisted): 52.149.20.212, 2.16.100.168, 88.221.110.91
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ocsp.edge.digicert.com, sls.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, download.windowsupdate.com.edgesuite.net
  • Execution Graph export aborted for target SecuriteInfo.com.Win64.Malware-gen.324.4623.exe, PID 5312 because there are no executed function
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
fp2e7a.wpc.phicdn.netindex.COzLCLj2.jsGet hashmaliciousUnknownBrowse
  • 192.229.221.95
index.COzLCLj2.jsGet hashmaliciousUnknownBrowse
  • 192.229.221.95
SecuriteInfo.com.Win32.TrojanX-gen.30614.13767.exeGet hashmaliciousUnknownBrowse
  • 192.229.221.95
https://url.emailprotection.link/?bb_LKUvGoDRiZNFStkLZMDx50G6P7K8P7j3oqki678d-X27iUkKce7hTMi3s4B8z6JV0veILnwstYKcDczUz85g~~Get hashmaliciousUnknownBrowse
  • 192.229.221.95
https://document.cert-sha256.com/pages/10ab5b62ac22/XdXJasPWh0dHqBzOi8vZGo9jdW1ldmbnQufY2VydC1zfaGkEyNTYuY29tL3BhZ2VzhLzEwYWI1YjYyYWMyMiZlbWFpbF90ZW1wbGF0ZV9pZD04MjI4NjI5JmFjdGlvbj1wcmV2aWV3JnVzZXJfaWQ9NzM0MTE0NTY=Get hashmaliciousUnknownBrowse
  • 192.229.221.95
http://link.adultspace.com/link/67097a59d79290df75176b77/aHR0cHM6Ly93d3cuZnVja2Jvb2tkYXRpbmcubmV0L2VuL2F1dGg_dXNlcj00MzMwMDA4NzEmY29kZT0xZDE3OTYyMTE3YWUwMzNjN2QyOWFlOTdkZWFhZjY1MyZyZWRpcmVjdFBhZ2U9JTJGYWNjb3VudCZyZWRpcmVjdFBhZ2VQYXJhbXMlNUJ1c2VyJTVEPTQzMzAwMDg3MQ==?linkId=link_9Get hashmaliciousUnknownBrowse
  • 192.229.221.95
http://link.adultspace.com/link/67097a59d79290df75176b77/aHR0cHM6Ly93d3cuZnVja2Jvb2tkYXRpbmcubmV0L2VuL2F1dGg_dXNlcj00MzMwMDA4NzEmY29kZT0xZDE3OTYyMTE3YWUwMzNjN2QyOWFlOTdkZWFhZjY1MyZyZWRpcmVjdFBhZ2U9JTJGYWNjb3VudCZyZWRpcmVjdFBhZ2VQYXJhbXMlNUJ1c2VyJTVEPTQzMzAwMDg3MQ==Get hashmaliciousUnknownBrowse
  • 192.229.221.95
https://confortdelaine.net/_t/c/A1020005-17FCC5B24D42434C-5CDEDE8F?l=AAAcWO23QzNrEQxSjr27S8EFVt7VLHdC62ZtcWocfX6Lqz5uexYrDxi+sVUvGeb6WoWr+1u86px6CeqKmXIOCUTvPxf5y1m+92lyrmRbK8koT6wtQAJk1YWaWBUMFIJ/3vsc2WvdtIwJaTxabsh+W+vUf4LC8SjYhEVylj55bIMdwbSSJa1w8dgA8TTZ2SM/gwTpERjPPbRkx4FbDzbbPD8sQxddZKtVA6IgU04s1TstolsJV14JD6qq3dThT2tvGDRLjfGCvSgCPZd7w/EyFIFEQHwfUU/HI6XrI0rF1TH49jLYmBCt6aM1i5EKOLkc84HNzk++/61mojPuIRtNzEb6nCJSn0uIrINbxC3a/h+jwOv+etRKwfazaX36q5rqMUkg7+72brLc0F+ETwf/n2D9sm5B&c=AAAjo61gfPXhnDrDZiQWifHv7rD2NYOqwsuVspF2RS9IblZOfkZjghuArWq+iDzUEo4uzagtI85Dn9WuD3xCdbIGnyuG/OMCUkjWs4/BJ1z4bkcSbqv5gpXb267b5Vksam/C1UnuMvw5djprO9vH/32M1mZTJ8E9Cfewh4m1ijNnGnDLQScKXjwrZnRRcepctU+T17PVlhhhsXZXlGMtSeSJNqYDm9oNRtjtX/b+pEGqbP9l3Zyfdqd7/Eg01VNrD3vN0sQSvKY0ZMfpHvt5IHiftD8MqDnx/UP9k2+EM+rpBGV67sdBcP7cRh7qqIWWdatJsul7GBZYxro1/8CucGL8Sp52bY4u33bRQk6qkAPBZ0hQiVMfefehxFiFxLH55NSbDb5olUs55mKzykakJoP8EaotmgHCKSAY2Yi5b7cZ9Fcwt91uTFUEJCr0saI4Teci+zUQyur4kOkhNuNRT6RHhAbwrDIhKXAF7+Ij/OpOO1fsMUhaRQNC/TtJG1X0SY6WbN4otB3e7WEN2lEtkxaY8yl1qZ1I0Vl3zzA1AyctEO/H88RXQsZ843T4CYdgAakKVXjBJ6FQlxtDcmP+N7K2vI9tIrC+EuchPJVGqS93dkrDg/qhkVccz3/YHVfPSkU5Zg==Get hashmaliciousUnknownBrowse
  • 192.229.221.95
http://starlightps.org/Get hashmaliciousUnknownBrowse
  • 192.229.221.95
670937a58778f_LisioFirendes.exeGet hashmaliciousLummaCBrowse
  • 192.229.221.95

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):6.230607257836249
TrID:
  • Win64 Executable (generic) (12005/4) 74.95%
  • Generic Win/DOS Executable (2004/3) 12.51%
  • DOS Executable Generic (2002/1) 12.50%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:SecuriteInfo.com.Win64.Malware-gen.324.4623.exe
File size:5'777'920 bytes
MD5:eaa5207750d5fc8204170ec6bda64cca
SHA1:34828c5aa252a5e83127d1185edcee869f611567
SHA256:1ed69b65f453f2f8363a8988d0b069c66c045cc28232dfd2935dddbd9fcfe011
SHA512:23f20623953094a56bb8367b5ce8de218710cb1f77c35be16a2241d544b917f5936331d442b85fafb7ed42512b5bbe57e374bb1e944ea421a114f3e9ed16f3ae
SSDEEP:49152:w4PgbU3D4Btrb/TavO90dL3BmAFd4A64nsfJLfL8Suvg62MbDZMawwoKTJdx9UXQ:r3+3uZ2pJCwO0EKD2+OZ
TLSH:BA464A07F95194E8C1EED134C626D292BA717C981B3023D32B61FBB92B77BD46A79310
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........(X.......".......*.........`F........@...............................^...........`... ............................

File Icon

Icon Hash:00928e8e8686b000

Static PE Info

General

Entrypoint:0x464660
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows cui
Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:1
File Version Major:6
File Version Minor:1
Subsystem Version Major:6
Subsystem Version Minor:1
Import Hash:9cbefe68f395e67356e2a5d8d1b285c0

Entrypoint Preview

Instruction
jmp 00007FA230608E20h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
dec eax
sub esp, 30h
dec ecx
mov edi, eax
dec eax
mov edx, dword ptr [00000028h]
dec eax
cmp edx, 00000000h
jne 00007FA23060CAEEh
dec eax
mov eax, 00000000h
jmp 00007FA23060CB65h
dec eax
mov edx, dword ptr [edx+00000000h]
dec eax
cmp edx, 00000000h

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x5e00000x47c.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x5e10000xb944.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x5202000x140.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x2a14650x2a1600d616a917ce0da8cd53f47f12a5b7f34eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x2a30000x27c1380x27c2000266cbf31273208f47c9d92952ec262cunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x5200000xbfa900x58a0083cc7b9e235dbdda845ec6d95c8f0caeFalse0.516451428067701data5.910321892521645IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata0x5e00000x47c0x60074970e01edf239bca63d9626a313ecbaFalse0.3313802083333333data3.506040536922964IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc0x5e10000xb9440xba006db2983cd1868ae4470ec2ceb9dda129False0.26178175403225806data5.4374883795923425IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab0x5ed0000x40x20007b5472d347d42780469fb2654b7fc54False0.02734375data0.020393135236084953IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLLImport
kernel32.dllWriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Network Behavior

DNS Answers

TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
Oct 12, 2024 12:40:31.168582916 CEST1.1.1.1192.168.2.50xf182No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
Oct 12, 2024 12:40:31.168582916 CEST1.1.1.1192.168.2.50xf182No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:06:40:18
Start date:12/10/2024
Path:C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exe
Wow64 process (32bit):false
Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.324.4623.exe"
Imagebase:0xeb0000
File size:5'777'920 bytes
MD5 hash:EAA5207750D5FC8204170EC6BDA64CCA
Has elevated privileges:true
Has administrator privileges:true
Programmed in:Go lang
Reputation:low
Has exited:true

General

Target ID:1
Start time:06:40:18
Start date:12/10/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Disassembly

⊘No disassembly