Windows Analysis Report
SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe

Overview

General Information

Sample name: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe
Analysis ID: 1532743
MD5: 5656520dd201e786dbcbd4043409c921
SHA1: c1ffb9889a94f6fb5d34386ebdd0e7dac3b2858c
SHA256: fd8d9c433aad9059017c03b07f6d59458b1c9cb0829ee08dc65f816b15ddfdfc
Tags: exe
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to retrieve information about pressed keystrokes
Found large amount of non-executed APIs
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe ReversingLabs: Detection: 31%
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\net\source\repos\macro external\x64\Release\macro external.pdb&& source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe
Source: Binary string: C:\Users\net\source\repos\macro external\x64\Release\macro external.pdb source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Code function: 0_2_00007FF6CEBF1570 GetStdHandle,SetConsoleTextAttribute,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,system,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,system,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,GetAsyncKeyState,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,system,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,GetAsyncKeyState,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,system,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,Sleep,FreeConsole,GetAsyncKeyState,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,Sleep,?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,Sleep,_invalid_parameter_noinfo_noreturn, 0_2_00007FF6CEBF1570
Source: classification engine Classification label: mal48.winEXE@2/1@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe ReversingLabs: Detection: 31%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\net\source\repos\macro external\x64\Release\macro external.pdb&& source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe
Source: Binary string: C:\Users\net\source\repos\macro external\x64\Release\macro external.pdb source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe API coverage: 9.1 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Code function: 0_2_00007FF6CEBF2F40 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6CEBF2F40
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Code function: 0_2_00007FF6CEBF30E4 SetUnhandledExceptionFilter, 0_2_00007FF6CEBF30E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Code function: 0_2_00007FF6CEBF2F40 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6CEBF2F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Code function: 0_2_00007FF6CEBF2C60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF6CEBF2C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe Code function: 0_2_00007FF6CEBF2E1C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF6CEBF2E1C
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1532743 Sample: SecuriteInfo.com.Trojan.Gen... Startdate: 13/10/2024 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 SecuriteInfo.com.Trojan.GenericKD.73712167.7295.25660.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
⊘No contacted IP infos