Edit tour

Windows Analysis Report
amneziawg.exe

Overview

General Information

Sample name:	amneziawg.exe
Analysis ID:	1532546
MD5:	9c3859eba6a53e9df1d885c8147337bd
SHA1:	2adb6cc21f9973f1aa7a083fe86c4b88a9a5f58c
SHA256:	ba23f928c64cca759bbf6f1f8318300ea384662f8b0c40bf22eb059beefc37af
Tags:	exeuser-Bacn
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected UAC Bypass using CMSTP

Creates a process in suspended mode (likely to inject code)

Installs a raw input device (often for capturing keystrokes)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Yara signature match

Classification

Process Tree

System is w10x64

amneziawg.exe (PID: 2700 cmdline: "C:\Users\user\Desktop\amneziawg.exe" MD5: 9C3859EBA6A53E9DF1D885C8147337BD)

amneziawg.exe (PID: 3340 cmdline: "C:\Users\user\Desktop\amneziawg.exe" /installmanagerservice MD5: 9C3859EBA6A53E9DF1D885C8147337BD)

amneziawg.exe (PID: 7156 cmdline: C:\Users\user\Desktop\amneziawg.exe /managerservice MD5: 9C3859EBA6A53E9DF1D885C8147337BD)

amneziawg.exe (PID: 3176 cmdline: C:\Users\user\Desktop\amneziawg.exe /ui 764 760 772 780 MD5: 9C3859EBA6A53E9DF1D885C8147337BD)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
amneziawg.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
amneziawg.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3370356203.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000000.2118774849.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000000.2117248766.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000002.2125608494.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2118135735.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000000.2114585117.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.3370357272.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000000.2120858143.0000000000C72000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: amneziawg.exe PID: 2700	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: amneziawg.exe PID: 3340	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: amneziawg.exe PID: 7156	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: amneziawg.exe PID: 3176	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
0.0.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.0.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
4.2.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
2.0.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.0.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
0.2.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
1.0.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.0.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
4.0.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.0.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
1.2.amneziawg.exe.980000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.amneziawg.exe.980000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3c9782:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3cf731:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x49d5cd:$s1: CoGetObject
Click to see the 11 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: amneziawg.exe, type: SAMPLE
Source: Yara match	File source: 2.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3370356203.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2118774849.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2117248766.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2125608494.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2118135735.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2114585117.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3370357272.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2120858143.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: amneziawg.exe PID: 2700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: amneziawg.exe PID: 3340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: amneziawg.exe PID: 7156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: amneziawg.exe PID: 3176, type: MEMORYSTR

Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG\Data	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG\Data\log.bin	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG\Data\Configurations	Jump to behavior

Source: amneziawg.exe

Static PE information: certificate valid

Source: amneziawg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: amneziawg.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: amneziawg.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: amneziawg.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: amneziawg.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: amneziawg.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: amneziawg.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: amneziawg.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: amneziawg.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: amneziawg.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: amneziawg.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: amneziawg.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: amneziawg.exe	String found in binary or memory: https://amnezia.org/D
Source: amneziawg.exe	String found in binary or memory: https://amnezia.org/wireguard-log-%s.txtTaskbarButtonCreatedreflect.Value.IsZeroreflect.Value.SetInt
Source: amneziawg.exe, 00000000.00000002.2120077035.000000C0000E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS
Source: amneziawg.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: amneziawg.exe, 00000000.00000002.2120077035.000000C0000E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS2.23.140.1.4.1

Source: amneziawg.exe, 00000000.00000002.2118135735.0000000000C72000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: FwpmEngineOpen0FwpmFreeMemory0handshakeZeroedGetModuleHandleclientCompositeSetActiveWindowwidget requiredCreatePopupMenuSysTabControl32ToolbarWindow32RegisterClassExExcludeClipRectGetEnhMetaFileWGetTextMetricsWPlayEnhMetaFileNotTrueTypeFontProfileNotFoundGdiplusShutdownGetThreadLocaleOleUninitializewglGetCurrentDCDragAcceptFilesCallWindowProcWCreateWindowExWDialogBoxParamWGetActiveWindowGetDpiForWindowGetMonitorInfoWGetRawInputDataInsertMenuItemWIsWindowEnabledPostQuitMessageSetWinEventHookTrackMouseEventWindowFromPointDrawThemeTextExzipinsecurepathjstmpllitinterptarinsecurepathx509usepoliciesinvalid pointerWintunSetLoggeravx512vpopcntdq&Save to file

memstr_8f1681dd-b

System Summary

Malicious sample detected (through community Yara rule)

Source: amneziawg.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: amneziawg.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.0.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.amneziawg.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal56.expl.winEXE@6/1@0/0

Source: C:\Users\user\Desktop\amneziawg.exe

File created: C:\Program Files\AmneziaWG

Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe	File opened: C:\Windows\system32\eca7494d4e254c1e0b6e04506a7fd3f00de299ec8a858d9b22102932b4e93054AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	File opened: C:\Windows\system32\5919c4fa007950ff9fd565974fab4216e24214c0fbc7da20a4a904f9e5cd40f0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	File opened: C:\Windows\system32\54d556396c49db0a849f394780942514ba738478999859b49a72fe90147340d7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	File opened: C:\Windows\system32\c84f4d8d6396fed1d59d385764634dd02067f628821080447a8dc9cfdbd3e9e5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior

Source: amneziawg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\amneziawg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: amneziawg.exe	String found in binary or memory: pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong Ptrace: out of memorywirep: already in goGetProcessMemoryInfobcryptprimitives.dllinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outEgyptian_HieroglyphsMeroitic_Hieroglyphsinvalid DNS responsegetadaptersaddressesunexpected network: bind is already openadding existing peerother UAPI error: %wextra data in bufferbitmap cannot be nilSetBrushOrgEx failedparent cannot be nilmin must be positiveInitCommonControlsExCommDlgExtendedErrorAddFontMemResourceExGetEnhMetaFileHeaderPropertyNotSupportedUnknown Status ValueFileTimeToSystemTimeSystemTimeToFileTimewglGetCurrentContextSHGetPathFromIDListWflate: closed writerhttplaxcontentlengthx509usefallbackrootsmissing IPv6 addressunexpected characterWintunGetAdapterLUIDexpression too largeinvalid repeat countAmneziaWG DeactivatedBind close failed: %vExport tunnels to zipInvalid endpoint hostKey must have a valuePersistent keepalive:Tunnel already existsUAPI: Updating fwmark/installtunnelserviceunsupported operationreflect.Value.Complex186264514923095703125931322574615478515625Morocco Standard TimeNamibia Standard TimeAlaskan Standard TimeCentral Standard TimePacific Standard TimeEastern Standard TimeSE Asia Standard TimeArabian Standard TimeMagadan Standard TimeMyanmar Standard TimeYakutsk Standard TimeBelarus Standard TimeRussian Standard TimeRomance Standard TimeSaratov Standard TimeNorfolk Standard Timetrace/breakpoint trapuser defined signal 1user defined signal 2CM_Get_DevNode_StatusAdjustTokenPrivilegesChangeServiceConfig2WDeregisterEventSourceEnumServicesStatusExWGetNamedSecurityInfoWLookupPrivilegeValueWSetNamedSecurityInfoWDwmGetWindowAttributeDwmSetWindowAttributeGetVolumeInformationWReadDirectoryChangesWNetGetJoinInformationNtCreateNamedPipeFileSetupDiEnumDeviceInfoSetupUninstallOEMInfWWSALookupServiceNextWWTSEnumerateSessionsWSeLoadDriverPrivilegebad type in compare: of unexported methodunexpected value stepreflect.Value.SetZeroreflect.Value.Pointerreflect.Value.SetUintnegative shift amountconcurrent map writes/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionNetUserGetLocalGroupsGetProfilesDirectoryWlink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleAnatolian_HieroglyphsInscriptional_Pahlavilocalhost.localdomaininitPacketMagicHeaderFwpmTransactionAbort0FwpmTrans
Source: amneziawg.exe	String found in binary or memory: Interface up requested[EnumerationSeparator]/installmanagerservicereflectlite.Value.Type0123456789aAbBcCdDeEfFexpected quoted string4656612873077392578125Sao Tome Standard TimeAleutian Standard TimeParaguay Standard TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard TimeCaucasus Standard TimeTasmania Standard TimeDateline Standard TimeHawaiian Standard TimeConvertSidToStringSidWConvertStringSidToSidWEnumDependentServicesWCreateIoCompletionPortGetEnvironmentStringsWGetTimeZoneInformationWaitForMultipleObjectsNtSetSystemInformationRtlDeleteFunctionTableRtlGetNtVersionNumbersSetupDiEnumDriverInfoWSetupDiGetClassDevsExWCreateEnvironmentBlockWSAGetOverlappedResultWSALookupServiceBeginWAMNEZIAWG_TUNNEL_NAME=Session has logged outreflectlite.Value.Elemunexpected method stepreflect.Value.MapIndexreflect.Value.SetFloatinteger divide by zeroCountPagesInUse (test)ReadMetricsSlow (test)trace reader (blocked)trace goroutine statussend on closed channelcall not at safe pointgetenv before env initinterface conversion: freeIndex is not validoldoverflow is not nils.freeindex > s.nelemsbad sweepgen in refillspan has no free space/gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type non-Go function at pc=RtlLookupFunctionEntryargument list too longaddress already in usenetwork is unreachablecannot allocate memoryprotocol not availableprotocol not supportedremote address changedInscriptional_ParthianNyiakeng_Puachue_Hmong%SystemRoot%\system32\.localhost.localdomainmissing ']' in addressinvalid address familyoperation was canceledresponsePacketJunkSizeFwpmTransactionCommit0CancelMibChangeNotify2invalid message lengthslice length too largeunsupported image typebuffered BitBlt failedCreateWindowEx(BUTTON)SetMenuItemInfo failedPlayEnhMetaFile failedcreating static failedWireGuard UI - TabPageCreateCompatibleBitmapwglRealizeLayerPaletteGetSystemMetricsForDpiRegisterWindowMessageWzip: file closed twicecatmsg: illegal varintunexpected length codeIPv4 address too shortmultiple :: in addressskipping Question Nameskipping Question TypeWintunGetReadWaitEventerror parsing regexp: Error Exiting WireGuardUnable to create tunnelUnable to delete tunnel/uninstalltunnelservicereflectlite.Value.IsNil<invalid reflect.Value>0123456789aAbBcCdDeEfF_23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" no
Source: amneziawg.exe	String found in binary or memory: " not supported for cpu option "unexpected character, want colonchacha20: invalid buffer overlap%v - Failed to derive keypair: %v%v - Sending handshake initiation%v - UAPI: Updating preshared keyFailed to create cookie reply: %vFailed to decode response messageInvalid key for interface sectionReceived packet with invalid mac1Receiving cookie response from %sThe %s tunnel has been activated.UAPI: Using default response typeno configuration files were found/installtunnelservice CONFIG_PATH142108547152020037174224853515625710542735760100185871124267578125CryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWSCGQUUSGSCOMPRKCYMSPMSRBATFMYTATNbytes.Buffer.Grow: negative countreflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangesync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of rangeskip everything and stop the walktoo many levels of symbolic linkswaiting for unsupported file typego package net: confVal.netCgo = Data directory is actually a filepersistent_keepalive_interval=%d
Source: amneziawg.exe	String found in binary or memory: " not supported for cpu option "unexpected character, want colonchacha20: invalid buffer overlap%v - Failed to derive keypair: %v%v - Sending handshake initiation%v - UAPI: Updating preshared keyFailed to create cookie reply: %vFailed to decode response messageInvalid key for interface sectionReceived packet with invalid mac1Receiving cookie response from %sThe %s tunnel has been activated.UAPI: Using default response typeno configuration files were found/installtunnelservice CONFIG_PATH142108547152020037174224853515625710542735760100185871124267578125CryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWSCGQUUSGSCOMPRKCYMSPMSRBATFMYTATNbytes.Buffer.Grow: negative countreflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangesync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of rangeskip everything and stop the walktoo many levels of symbolic linkswaiting for unsupported file typego package net: confVal.netCgo = Data directory is actually a filepersistent_keepalive_interval=%d
Source: amneziawg.exe	String found in binary or memory: " not supported for cpu option "unexpected character, want colonchacha20: invalid buffer overlap%v - Failed to derive keypair: %v%v - Sending handshake initiation%v - UAPI: Updating preshared keyFailed to create cookie reply: %vFailed to decode response messageInvalid key for interface sectionReceived packet with invalid mac1Receiving cookie response from %sThe %s tunnel has been activated.UAPI: Using default response typeno configuration files were found/installtunnelservice CONFIG_PATH142108547152020037174224853515625710542735760100185871124267578125CryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWSCGQUUSGSCOMPRKCYMSPMSRBATFMYTATNbytes.Buffer.Grow: negative countreflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangesync: RUnlock of unlocked RWMutexslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of rangeskip everything and stop the walktoo many levels of symbolic linkswaiting for unsupported file typego package net: confVal.netCgo = Data directory is actually a filepersistent_keepalive_interval=%d
Source: amneziawg.exe	String found in binary or memory: Permit inbound on loopback (IPv4)Permit inbound on loopback (IPv6)Error converting luid to guid: %wUnable to create Wintun interfacehex string does not fit the slicewidget must be child of containerSendMessage(TCM_SETCURSEL) failedfailed to create clipboard windowFailed to get comctl32.dll handlecatmsg: no translation for inputsleafCounts[maxBits][maxBits] != nGODEBUG: no value specified for "too many Answers to pack (>65535)encoding: missing byte order markRegistered I/O is unavailable: %vGODEBUG sys/cpu: can not enable "regexp: unhandled case in compile%v - Received handshake initiation%v - UAPI: Removing all allowedipsReceived message with unknown typeUAPI: Using default transport typeUAPI: Using default underload typeUnable to create new configurationUnable to import configuration: %vfailed to restrict dll search path3552713678800500929355621337890625: day-of-year does not match monthCM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModesbytes: Join output length overflowreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangereflect.Value.Grow: slice overflowslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timertoo many references: cannot spliceunexpected runtime.netpoll error: Permit inbound IPv4 traffic on TUNPermit inbound IPv6 traffic on TUNPermit outbound on loopback (IPv4)Permit outbound on loopback (IPv6)Unable to set device configurationtrailing character in UAPI get: %qname too long (%d bytes): %.20q...SendMessage(TCM_INSERTITEM) failedGetPhysicallyInstalledSystemMemoryillegal base64 data at input byte NoDefaultCurrentDirectoryInExePathGODEBUG sys/cpu: can not disable "invalid nested repetition operatorinvalid or unsupported Perl syntaxchacha20: wrong HChaCha20 key sizeFailed to decode initiation messageInvalid key for [Interface] sectionThe %s tunnel has been deactivated.UAPI: Updating junk_packet_max_sizeUAPI: Updating junk_packet_min_size/uninstalltunnelservice TUNNEL_NAMEunsigned integer overflow on token 1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 92006-01-02T15:04:05.999999999Z07:00non-positive interval for NewTickerSubscribeServiceChangeNotificationsParseAcceptLanguage: invalid weightreflect.MakeSlice of non-slice typepersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queue
Source: amneziawg.exe	String found in binary or memory: Permit inbound on loopback (IPv4)Permit inbound on loopback (IPv6)Error converting luid to guid: %wUnable to create Wintun interfacehex string does not fit the slicewidget must be child of containerSendMessage(TCM_SETCURSEL) failedfailed to create clipboard windowFailed to get comctl32.dll handlecatmsg: no translation for inputsleafCounts[maxBits][maxBits] != nGODEBUG: no value specified for "too many Answers to pack (>65535)encoding: missing byte order markRegistered I/O is unavailable: %vGODEBUG sys/cpu: can not enable "regexp: unhandled case in compile%v - Received handshake initiation%v - UAPI: Removing all allowedipsReceived message with unknown typeUAPI: Using default transport typeUAPI: Using default underload typeUnable to create new configurationUnable to import configuration: %vfailed to restrict dll search path3552713678800500929355621337890625: day-of-year does not match monthCM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModesbytes: Join output length overflowreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangereflect.Value.Grow: slice overflowslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already set in timertoo many references: cannot spliceunexpected runtime.netpoll error: Permit inbound IPv4 traffic on TUNPermit inbound IPv6 traffic on TUNPermit outbound on loopback (IPv4)Permit outbound on loopback (IPv6)Unable to set device configurationtrailing character in UAPI get: %qname too long (%d bytes): %.20q...SendMessage(TCM_INSERTITEM) failedGetPhysicallyInstalledSystemMemoryillegal base64 data at input byte NoDefaultCurrentDirectoryInExePathGODEBUG sys/cpu: can not disable "invalid nested repetition operatorinvalid or unsupported Perl syntaxchacha20: wrong HChaCha20 key sizeFailed to decode initiation messageInvalid key for [Interface] sectionThe %s tunnel has been deactivated.UAPI: Updating junk_packet_max_sizeUAPI: Updating junk_packet_min_size/uninstalltunnelservice TUNNEL_NAMEunsigned integer overflow on token 1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 92006-01-02T15:04:05.999999999Z07:00non-positive interval for NewTickerSubscribeServiceChangeNotificationsParseAcceptLanguage: invalid weightreflect.MakeSlice of non-slice typepersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queue
Source: amneziawg.exe	String found in binary or memory: net/addrselect.go
Source: amneziawg.exe	String found in binary or memory: github.com/amnezia-vpn/amneziawg-go@v0.2.8/device/noise-helpers.go
Source: amneziawg.exe	String found in binary or memory: github.com/amnezia-vpn/amneziawg-windows@v0.1.4-0.20240526104134-db18f2297e5e/tunnel/addressconfig.go
Source: amneziawg.exe	String found in binary or memory: github.com/amnezia-vpn/amneziawg-windows-client/elevate/loader.go
Source: amneziawg.exe	String found in binary or memory: github.com/amnezia-vpn/amneziawg-windows-client/manager/install.go
Source: amneziawg.exe	String found in binary or memory: github.com/lxn/walk@v0.0.0-20210112085537-c389da54e794/stopwatch.go
Source: amneziawg.exe	String found in binary or memory: github.com/lxn/walk@v0.0.0-20210112085537-c389da54e794/stopwatch.go

Source: C:\Users\user\Desktop\amneziawg.exe

File read: C:\Users\user\Desktop\amneziawg.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\amneziawg.exe "C:\Users\user\Desktop\amneziawg.exe"
Source: C:\Users\user\Desktop\amneziawg.exe	Process created: C:\Users\user\Desktop\amneziawg.exe "C:\Users\user\Desktop\amneziawg.exe" /installmanagerservice
Source: unknown	Process created: C:\Users\user\Desktop\amneziawg.exe C:\Users\user\Desktop\amneziawg.exe /managerservice
Source: C:\Users\user\Desktop\amneziawg.exe	Process created: C:\Users\user\Desktop\amneziawg.exe C:\Users\user\Desktop\amneziawg.exe /ui 764 760 772 780
Source: C:\Users\user\Desktop\amneziawg.exe	Process created: C:\Users\user\Desktop\amneziawg.exe "C:\Users\user\Desktop\amneziawg.exe" /installmanagerservice	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process created: C:\Users\user\Desktop\amneziawg.exe C:\Users\user\Desktop\amneziawg.exe /ui 764 760 772 780	Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Section loaded: explorerframe.dll	Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe

Window detected: Number of UI elements: 15

Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG\Data	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG\Data\log.bin	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Directory created: C:\Program Files\AmneziaWG\Data\Configurations	Jump to behavior

Source: amneziawg.exe

Static PE information: certificate valid

Source: amneziawg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: amneziawg.exe

Static file information: File size 8231576 > 1048576

Source: amneziawg.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2f0200
Source: amneziawg.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x3b2400

Source: amneziawg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: amneziawg.exe	Static PE information: section name: .xdata
Source: amneziawg.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: amneziawg.exe, 00000004.00000002.3374666441.00000278C1D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll??]
Source: amneziawg.exe, 00000000.00000002.2121805539.000001E310258000.00000004.00000020.00020000.00000000.sdmp, amneziawg.exe, 00000001.00000002.2130844942.000001DE3141E000.00000004.00000020.00020000.00000000.sdmp, amneziawg.exe, 00000002.00000002.3374324008.0000022A76328000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\amneziawg.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe	Process created: C:\Users\user\Desktop\amneziawg.exe "C:\Users\user\Desktop\amneziawg.exe" /installmanagerservice			Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Process created: C:\Users\user\Desktop\amneziawg.exe C:\Users\user\Desktop\amneziawg.exe /ui 764 760 772 780			Jump to behavior

Source: amneziawg.exe	Binary or memory string: %sinvalid styleSetWindowLongeffect == nilShell_TrayWndDestroyWindowSysListView32SelectedCountGetWindowLongLVM_SETCOLUMNGetWindowRectGetClientRectImageList_AddCreateRectRgnGetDeviceCapsSetBrushOrgExValueOverflowCreateActCtxWRtlMoveMemoryOleInitializeSysFreeStringwglShareListsPdhCloseQueryAnimateWindowDrawFocusRectGetMenuItemIDGetScrollInfoGetSystemMenuSetScrollInfoGetThemeColorOpenThemeDataEnumPrintersWRoundingMode(gocacheverifyinstallgoroothtml/templatetlsmaxrsasizeinvalid port name too longcq is corruptnot availableinvalid UTF-8Device closingPreshared key:listen_port=%dunexpected EOFComputerNameExinvalid syntax1907348632812595367431640625: extra text: ControlServiceCreateServiceWCryptGenRandomIsWellKnownSidMakeAbsoluteSDOpenSCManagerWSetThreadTokenCertCloseStoreCreateEventExWCreateMutexExWCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressGetTickCount64IsWow64ProcessLoadLibraryExWModule32FirstWProcess32NextWSetConsoleModeSetFilePointerSizeofResourceVirtualProtectVirtualQueryExNetUserGetInfoCoInitializeExCoUninitializeGetUserNameExWTranslateNameWGetShellWindowVerQueryValueWgetprotobyname procedure in Executing: %#qAdministrators/tunnelservice on zero Valueunknown methodunsafe.PointeruserArenaStateread mem statsallocfreetracegcstoptheworldGC assist waitfinalizer waitsync.Cond.Waits.allocCount= key size wrongnil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriodbad restart PC-thread limit
Source: amneziawg.exe	Binary or memory string: %sinvalid styleSetWindowLongeffect == nilShell_TrayWndDestroyWindowSysListView32SelectedCountGetWindowLongLVM_SETCOLUMNGetWindowRectGetClientRectImageList_AddCreateRectRgnGetDeviceCapsSetBrushOrgExValueOverflowCreateActCtxWRtlMoveMemoryOleInitializeSysFreeStringwglShareListsPdhCloseQueryAnimateWindowDrawFocusRectGetMenuItemIDGetScrollInfoGetSystemMenuSetScrollInfoGetThemeColorOpenThemeDataEnumPrintersWRoundingMode(gocacheverifyinstallgoroothtml/templatetlsmaxrsasizeinvalid port name too longcq is corruptnot availableinvalid UTF-8Device closingPreshared key:listen_port=%dunexpected EOFComputerNameExinvalid syntax1907348632812595367431640625: extra text: ControlServiceCreateServiceWCryptGenRandomIsWellKnownSidMakeAbsoluteSDOpenSCManagerWSetThreadTokenCertCloseStoreCreateEventExWCreateMutexExWCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressGetTickCount64IsWow64ProcessLoadLibraryExWModule32FirstWProcess32NextWSetConsoleModeSetFilePointerSizeofResourceVirtualProtectVirtualQueryExNetUserGetInfoCoInitializeExCoUninitializeGetUserNameExWTranslateNameWGetShellWindowVerQueryValueWgetprotobyname procedure in Executing: %#qAdministrators/tunnelservice on zero Valueunknown methodunsafe.PointeruserArenaStateread mem statsallocfreetracegcstoptheworldGC assist waitfinalizer waitsync.Cond.Waits.allocCount= key size wrongnil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriod
Source: amneziawg.exe, 00000004.00000002.3371139511.000000C00009C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Ctrl+NC:\Windows\system32\shell32.dllC:\Windows\system32\shell32.dllShell_TrayWnd&Import tunnel(s) from file
Source: amneziawg.exe, 00000004.00000002.3371139511.000000C00009C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Status: UnknownShell_TrayWndStatus: UnknownShell_TrayWndListen port:DNS servers:Import tunnel(s) from fileListen port:DNS servers:Listen port:DNS servers:Import tunnel(s) from file

Source: C:\Users\user\Desktop\amneziawg.exe	Queries volume information: C:\Program Files\AmneziaWG\Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Queries volume information: C:\Program Files\AmneziaWG\Data\Configurations VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Queries volume information: C:\Program Files\AmneziaWG\Data\Configurations VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Queries volume information: C:\Program Files\AmneziaWG\Data\Configurations VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Queries volume information: C:\Program Files\AmneziaWG\Data\Configurations VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Queries volume information: C:\Program Files\AmneziaWG\Data\Configurations VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\amneziawg.exe	Queries volume information: C:\Program Files\AmneziaWG\Data\Configurations VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\amneziawg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	2 Masquerading	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
amneziawg.exe	3%	ReversingLabs
amneziawg.exe	0%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	URL Reputation	safe
https://amnezia.org/D	2%	Virustotal		Browse
https://sectigo.com/CPS2.23.140.1.4.1	0%	Virustotal		Browse
https://sectigo.com/CPS	0%	Virustotal		Browse
https://amnezia.org/wireguard-log-%s.txtTaskbarButtonCreatedreflect.Value.IsZeroreflect.Value.SetInt	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	amneziawg.exe	false	URL Reputation: safe	unknown
https://sectigo.com/CPS	amneziawg.exe, 00000000.00000002.2120077035.000000C0000E2000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://amnezia.org/D	amneziawg.exe	false	2%, Virustotal, Browse	unknown
https://sectigo.com/CPS0	amneziawg.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	amneziawg.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	amneziawg.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	amneziawg.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	amneziawg.exe	false	URL Reputation: safe	unknown
https://amnezia.org/wireguard-log-%s.txtTaskbarButtonCreatedreflect.Value.IsZeroreflect.Value.SetInt	amneziawg.exe	false	2%, Virustotal, Browse	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	amneziawg.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	amneziawg.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	amneziawg.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	amneziawg.exe	false	URL Reputation: safe	unknown
https://sectigo.com/CPS2.23.140.1.4.1	amneziawg.exe, 00000000.00000002.2120077035.000000C0000E2000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532546
Start date and time:	2024-10-13 16:31:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	amneziawg.exe
Detection:	MAL
Classification:	mal56.expl.winEXE@6/1@0/0
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target amneziawg.exe, PID 2700 because it is empty
Execution Graph export aborted for target amneziawg.exe, PID 3176 because it is empty
Execution Graph export aborted for target amneziawg.exe, PID 3340 because it is empty
Execution Graph export aborted for target amneziawg.exe, PID 7156 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files\AmneziaWG\Data\log.bin

Download File

Process:	C:\Users\user\Desktop\amneziawg.exe
File Type:	data
Category:	dropped
Size (bytes):	1064968
Entropy (8bit):	0.0027932901809495625
Encrypted:	false
SSDEEP:	6:Mo/lRpQ6H2AKTKBvPk6TmduWVyF9gzrP5C:MoC6WAKTKBvPk6pF+zr
MD5:	1EF81D45DD2A32DE7830ADA0375F7BF5
SHA1:	0E8E11AF3E20889450EEDEB30CCB9666ABFEA9EF
SHA-256:	626C4CF50BBF004DB256A7D01E48F01725FE59C8D8476897102FB3A8D7E43E3A
SHA-512:	4DAEC987C5900ACB48BDADCF3E7E543ED2FD14A8FA6A03808A6C3DD491D699FE513CD0C9F7227AC97A427C8E85C99EB18D4204FD7C359EE9BE23883AD608097B
Malicious:	false
Reputation:	low
Preview:	........4..+....[MGR] Starting AmneziaWG/1.0.0 (Windows 10.0.19045; amd64)...................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ..,....[MGR] Starting UI process for user .user@user-PC. for session 1.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.279002018539988
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	amneziawg.exe
File size:	8'231'576 bytes
MD5:	9c3859eba6a53e9df1d885c8147337bd
SHA1:	2adb6cc21f9973f1aa7a083fe86c4b88a9a5f58c
SHA256:	ba23f928c64cca759bbf6f1f8318300ea384662f8b0c40bf22eb059beefc37af
SHA512:	3824cb357c508f7a87894af928d97ad99d543e950af19bd82c0edda2196f36d272d27b54f1315a85921a41fb346b75b261e1fd366021f2b9623f810229300b93
SSDEEP:	98304:jHJNGoKgovuzo8bhevZrQZXE79+tA3wUkQok:xo27hevxKU7otA8QR
TLSH:	29863AC7AD914598DCA987F0896692623A70BC4C4FF693D33B21B7582F367D06B7A340
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........bq......."......./...................@.....................................s&~...`... ............................

File Icon


Icon Hash:	3370ccd6d4cc692b

Static PE Info

General

Entrypoint:	0x46dd00
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c2d457ad8ac36fc9f18d45bffcd450c2

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	31/08/2023 02:00:00 31/08/2026 01:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
jmp 00007FC6E933F600h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [00709A92h]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007FC6E9342F05h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007FC6E93438DBh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x794000	0x554	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7a8000	0xc06f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x77c000	0x168c0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7d6c00	0x2e98	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x795000	0x11faa	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6a5620	0x180	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2f01c6	0x2f0200	bac4717a3b7baf8ae7b00c4e66bf754f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2f2000	0x3b23e0	0x3b2400	416eedbdee6f75c1e0356aba62866a1f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6a5000	0xd6c60	0x4a400	a40485bd08a1bf4f02212a53a898bf19	False	0.34078414351851855	data	4.438560923126627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x77c000	0x168c0	0x16a00	8f01e16f39866c3ce4899ce04fa36242	False	0.3901717886740331	data	5.509527765883878	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x793000	0xb4	0x200	9429dd67ca883e67888efcb7512327d7	False	0.224609375	shared library	1.787112262798912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x794000	0x554	0x600	97f81edbedeb121cd609839463911428	False	0.3795572916666667	data	3.9924969780968635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x795000	0x11faa	0x12000	285bcb388db1369171a878e74588f16c	False	0.21012369791666666	data	5.458447502506389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x7a7000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x7a8000	0xc06f0	0xc0800	a36cbfd1fd3fd8bbbf39573dcb6b0d3f	False	0.35044389204545456	data	5.584675086600346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7a8b58	0x28b7a	PNG image data, 256 x 256, 16-bit/color RGBA, non-interlaced			1.000365755675209
RT_ICON	0x7d16d8	0x25228	Device independent bitmap graphic, 192 x 384 x 32, image size 147456, resolution 3779 x 3779 px/m			0.18735864934518487
RT_ICON	0x7f6900	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m			0.25810363184668167
RT_ICON	0x807128	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/m			0.3244692032793778
RT_ICON	0x8105d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m			0.43132971185640057
RT_ICON	0x8147f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m			0.5116182572614107
RT_ICON	0x816da0	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6400, resolution 3779 x 3779 px/m			0.5597633136094674
RT_ICON	0x818808	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m			0.6334427767354597
RT_ICON	0x8198b0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 3779 x 3779 px/m			0.703688524590164
RT_ICON	0x81a238	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600, resolution 3779 x 3779 px/m			0.7395348837209302
RT_ICON	0x81a8f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m			0.7721631205673759
RT_ICON	0x81adf8	0x24e2	PNG image data, 256 x 256, 16-bit gray+alpha, non-interlaced			0.9936454141071807
RT_ICON	0x81d2e0	0x25228	Device independent bitmap graphic, 192 x 384 x 32, image size 147456, resolution 3779 x 3779 px/m			0.047086204176090045
RT_ICON	0x842508	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m			0.060865964746243936
RT_ICON	0x852d30	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/m			0.07026487281900358
RT_ICON	0x85c1d8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m			0.08827350023618327
RT_ICON	0x860400	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m			0.10269709543568464
RT_ICON	0x8629a8	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6400, resolution 3779 x 3779 px/m			0.11789940828402366
RT_ICON	0x864410	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m			0.125
RT_ICON	0x8654b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 3779 x 3779 px/m			0.1540983606557377
RT_ICON	0x865e40	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600, resolution 3779 x 3779 px/m			0.18488372093023256
RT_ICON	0x8664f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m			0.19148936170212766
RT_GROUP_ICON	0x81ad58	0xa0	data			0.69375
RT_GROUP_ICON	0x866960	0xa0	data			0.7
RT_VERSION	0x868238	0x4b4	data	Chinese	Taiwan	0.45099667774086377
RT_VERSION	0x866a00	0x4d4	data	English	United States	0.43284789644012944
RT_VERSION	0x866ed8	0x4dc	data	French	France	0.430064308681672
RT_VERSION	0x8673b8	0x4dc	data	Italian	Italy	0.4316720257234727
RT_VERSION	0x867898	0x4c4	data	Japanese	Japan	0.4565573770491803
RT_VERSION	0x867d60	0x4d4	data	Slovenian	Slovenia	0.42961165048543687
RT_MANIFEST	0x7a85c8	0x58e	XML 1.0 document, ASCII text			0.39943741209563993

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan
English	United States
French	France
Italian	Italy
Japanese	Japan
Slovenian	Slovenia

Target ID:	0
Start time:	10:32:08
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\amneziawg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\amneziawg.exe"
Imagebase:	0x980000
File size:	8'231'576 bytes
MD5 hash:	9C3859EBA6A53E9DF1D885C8147337BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2118135735.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.2114585117.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:32:08
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\amneziawg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\amneziawg.exe" /installmanagerservice
Imagebase:	0x980000
File size:	8'231'576 bytes
MD5 hash:	9C3859EBA6A53E9DF1D885C8147337BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000000.2117248766.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.2125608494.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:32:08
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\amneziawg.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\amneziawg.exe /managerservice
Imagebase:	0x980000
File size:	8'231'576 bytes
MD5 hash:	9C3859EBA6A53E9DF1D885C8147337BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000000.2118774849.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.3370357272.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:32:09
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\amneziawg.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\amneziawg.exe /ui 764 760 772 780
Imagebase:	0x980000
File size:	8'231'576 bytes
MD5 hash:	9C3859EBA6A53E9DF1D885C8147337BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.3370356203.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000000.2120858143.0000000000C72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 009EE2A0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2117873898.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2117837933.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118135735.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118567555.0000000001025000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118690916.000000000102A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118724498.000000000102D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118759211.000000000102E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118933499.0000000001056000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118976494.0000000001057000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119013017.0000000001058000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119036068.0000000001059000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119090063.000000000105B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119113583.0000000001068000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119136633.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119160763.000000000106D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.000000000106E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.0000000001089000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.000000000108F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.00000000010F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119328302.00000000010FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119355045.0000000001114000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119377943.0000000001115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119377943.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_amneziawg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction ID: c7620dd07016295618f2fa9581421663232282e83aee4d25c59c917093547dee
Opcode Fuzzy Hash: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction Fuzzy Hash: 9D31986391CFC482D3218B25F5413AAB364F7A9784F15A715EFC812A1ADF38E2E5CB40

Function 009EA5E0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2117873898.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.2117837933.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118135735.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118567555.0000000001025000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118690916.000000000102A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118724498.000000000102D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118759211.000000000102E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118933499.0000000001056000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2118976494.0000000001057000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119013017.0000000001058000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119036068.0000000001059000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119090063.000000000105B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119113583.0000000001068000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119136633.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119160763.000000000106D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.000000000106E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.0000000001089000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.000000000108F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119184349.00000000010F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119328302.00000000010FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119355045.0000000001114000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119377943.0000000001115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119377943.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_amneziawg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction ID: a992bdb9de96ffcf336066b4e5bb68cc97d8973278ee78b4a32f132c0206305c
Opcode Fuzzy Hash: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction Fuzzy Hash:

Analysis Process: amneziawg.exePID: 3340, Parent PID: 2700COMMON

Executed Functions

Function 009EE2A0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2125328211.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000001.00000002.2125297212.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2125608494.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2125965569.0000000001025000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2125987653.000000000102A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126010113.000000000102D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126029501.000000000102E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126059946.0000000001056000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126083490.0000000001057000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126108435.0000000001058000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126130865.0000000001059000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126152802.000000000105B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126174465.0000000001068000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126199846.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126224516.000000000106D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.000000000106E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.0000000001089000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.000000000108F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.00000000010F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126651352.00000000010FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126699812.0000000001114000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126730529.0000000001115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126730529.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_980000_amneziawg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction ID: c7620dd07016295618f2fa9581421663232282e83aee4d25c59c917093547dee
Opcode Fuzzy Hash: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction Fuzzy Hash: 9D31986391CFC482D3218B25F5413AAB364F7A9784F15A715EFC812A1ADF38E2E5CB40

Function 009EA5E0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2125328211.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000001.00000002.2125297212.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2125608494.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2125965569.0000000001025000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2125987653.000000000102A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126010113.000000000102D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126029501.000000000102E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126059946.0000000001056000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126083490.0000000001057000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126108435.0000000001058000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126130865.0000000001059000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126152802.000000000105B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126174465.0000000001068000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126199846.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126224516.000000000106D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.000000000106E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.0000000001089000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.000000000108F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126282607.00000000010F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126651352.00000000010FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126699812.0000000001114000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126730529.0000000001115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2126730529.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_980000_amneziawg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction ID: a992bdb9de96ffcf336066b4e5bb68cc97d8973278ee78b4a32f132c0206305c
Opcode Fuzzy Hash: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction Fuzzy Hash:

Analysis Process: amneziawg.exePID: 3176, Parent PID: 7156COMMON

Executed Functions

Function 009EE2A0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3370116069.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000004.00000002.3370075473.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370356203.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370593192.0000000001025000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370619365.000000000102A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370646182.000000000102D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370670192.000000000102E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370702646.0000000001055000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370726798.0000000001057000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370753126.0000000001058000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370777119.000000000105A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370801207.000000000105B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370828716.0000000001068000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370852650.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370876127.000000000106D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370899444.000000000106E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370899444.0000000001089000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370899444.00000000010F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370981507.00000000010FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3371009621.0000000001114000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3371035554.0000000001115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3371035554.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_980000_amneziawg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction ID: c7620dd07016295618f2fa9581421663232282e83aee4d25c59c917093547dee
Opcode Fuzzy Hash: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
Instruction Fuzzy Hash: 9D31986391CFC482D3218B25F5413AAB364F7A9784F15A715EFC812A1ADF38E2E5CB40

Function 009EA5E0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3370116069.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000004.00000002.3370075473.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370356203.0000000000C72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370593192.0000000001025000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370619365.000000000102A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370646182.000000000102D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370670192.000000000102E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370702646.0000000001055000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370726798.0000000001057000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370753126.0000000001058000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370777119.000000000105A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370801207.000000000105B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370828716.0000000001068000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370852650.000000000106B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370876127.000000000106D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370899444.000000000106E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370899444.0000000001089000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370899444.00000000010F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3370981507.00000000010FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3371009621.0000000001114000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3371035554.0000000001115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3371035554.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_980000_amneziawg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction ID: a992bdb9de96ffcf336066b4e5bb68cc97d8973278ee78b4a32f132c0206305c
Opcode Fuzzy Hash: 6e2dc365eeaf7d755159d019c6b8806dfc90132728faab9ca90f57871b6c792b
Instruction Fuzzy Hash:

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report amneziawg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\AmneziaWG\Data\log.bin

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: amneziawg.exePID: 2700, Parent PID: 1028

General

Windows Analysis Report
amneziawg.exe