Edit tour

Windows Analysis Report
AlphaDecrypter.exe

Overview

General Information

Sample name:	AlphaDecrypter.exe
Analysis ID:	1532908
MD5:	61f559e667a8a8baa99aa9d81d2afbc0
SHA1:	c0d3114ab855a79e4ad229b8a6e253e1b2db2e64
SHA256:	05c1d10a8d9dd898f7e601a6032284814a640f5fa44e5fc380c17cbbe8940cd5
Tags:	exeuser-bicboi
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Malicious sample detected (through community Yara rule)

Allocates memory with a write watch (potentially for evading sandboxes)

Detected potential crypto function

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

AlphaDecrypter.exe (PID: 6876 cmdline: "C:\Users\user\Desktop\AlphaDecrypter.exe" MD5: 61F559E667A8A8BAA99AA9D81D2AFBC0)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp	Ransom_Alpha	Regla para detectar Ransom.Alpha (posibles falsos positivos)	CCN-CERT	0x6ffa:$a: 52 00 65 00 61 00 64 00 20 00 4D 00 65 00 20 00 28 00 48 00 6F 00 77 00 20 00 44 00 65 00 63
00000000.00000002.3033498403.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	Ransom_Alpha	Regla para detectar Ransom.Alpha (posibles falsos positivos)	CCN-CERT	0x112d2:$a: 52 00 65 00 61 00 64 00 20 00 4D 00 65 00 20 00 28 00 48 00 6F 00 77 00 20 00 44 00 65 00 63
00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	Ransom_Alpha	Regla para detectar Ransom.Alpha (posibles falsos positivos)	CCN-CERT	0x6a67c:$a: 52 00 65 00 61 00 64 00 20 00 4D 00 65 00 20 00 28 00 48 00 6F 00 77 00 20 00 44 00 65 00 63 0x6b0b2:$a: 52 00 65 00 61 00 64 00 20 00 4D 00 65 00 20 00 28 00 48 00 6F 00 77 00 20 00 44 00 65 00 63

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.AlphaDecrypter.exe.5830000.0.unpack	Ransom_Alpha	Regla para detectar Ransom.Alpha (posibles falsos positivos)	CCN-CERT	0x1b1fa:$a: 52 00 65 00 61 00 64 00 20 00 4D 00 65 00 20 00 28 00 48 00 6F 00 77 00 20 00 44 00 65 00 63

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: AlphaDecrypter.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: AlphaDecrypter.exe

Static PE information: certificate valid

Source: AlphaDecrypter.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: AlphaDecrypter.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AlphaDecrypter.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AlphaDecrypter.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: AlphaDecrypter.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: AlphaDecrypter.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AlphaDecrypter.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AlphaDecrypter.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AlphaDecrypter.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AlphaDecrypter.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: AlphaDecrypter.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: AlphaDecrypter.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/demonslay335
Source: AlphaDecrypter.exe, 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://twitter.com/demonslay335Ghttps://twitter.com/malwrhunterteam=https://twitter.com/hahn_katja9
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/hahn_katja
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/malwrhunterteam
Source: AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/siri_urz
Source: AlphaDecrypter.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Code function: 0_2_0A11D359 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_0A11D359

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.AlphaDecrypter.exe.5830000.0.unpack, type: UNPACKEDPE	Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT
Source: 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT
Source: 00000000.00000002.3033498403.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT
Source: 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Regla para detectar Ransom.Alpha (posibles falsos positivos) Author: CCN-CERT

Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_01660868	0_2_01660868
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_016614E2	0_2_016614E2
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_0A11A6D0	0_2_0A11A6D0
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_0A11B518	0_2_0A11B518
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_0A11B518	0_2_0A11B518
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_0A11A6D0	0_2_0A11A6D0
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_0A110670	0_2_0A110670
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Code function: 0_2_0A110667	0_2_0A110667

Source: AlphaDecrypter.exe, 00000000.00000002.3033498403.000000000167E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs AlphaDecrypter.exe

Source: AlphaDecrypter.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.AlphaDecrypter.exe.5830000.0.unpack, type: UNPACKEDPE	Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0
Source: 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0
Source: 00000000.00000002.3033498403.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0
Source: 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Ransom_Alpha author = CCN-CERT, description = Regla para detectar Ransom.Alpha (posibles falsos positivos), version = 1.0

Source: AlphaDecrypter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: sus36.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Mutant created: NULL

Source: AlphaDecrypter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AlphaDecrypter.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AlphaDecrypter.exe

Static PE information: certificate valid

Source: AlphaDecrypter.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AlphaDecrypter.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Code function: 0_2_016669EA push ecx; retf FFEDh

0_2_01666A0C

Source: AlphaDecrypter.exe

Static PE information: section name: .text entropy: 7.62629055697075

Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Memory allocated: 1640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Memory allocated: 3300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Memory allocated: 5300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Memory allocated: 5A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Memory allocated: 6A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Memory allocated: 6B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Memory allocated: 7B80000 memory reserve \| memory write watch	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Users\user\Desktop\AlphaDecrypter.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AlphaDecrypter.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AlphaDecrypter.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
AlphaDecrypter.exe	11%	ReversingLabs
AlphaDecrypter.exe	3%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://twitter.com/hahn_katja	0%	Virustotal		Browse
https://twitter.com/demonslay335Ghttps://twitter.com/malwrhunterteam=https://twitter.com/hahn_katja9	0%	Virustotal		Browse
https://twitter.com/siri_urz	0%	Virustotal		Browse
https://twitter.com/demonslay335	0%	Virustotal		Browse
https://twitter.com/malwrhunterteam	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.goodfont.co.kr	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/hahn_katja	AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.carterandcone.coml	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://twitter.com/siri_urz	AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/malwrhunterteam	AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.zhongyicts.com.cn	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/demonslay335	AlphaDecrypter.exe, 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.sakkal.com	AlphaDecrypter.exe, 00000000.00000002.3037155283.0000000009A52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/demonslay335Ghttps://twitter.com/malwrhunterteam=https://twitter.com/hahn_katja9	AlphaDecrypter.exe, 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532908
Start date and time:	2024-10-14 07:15:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AlphaDecrypter.exe
Detection:	SUS
Classification:	sus36.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 19 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.186721945926943
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AlphaDecrypter.exe
File size:	150'256 bytes
MD5:	61f559e667a8a8baa99aa9d81d2afbc0
SHA1:	c0d3114ab855a79e4ad229b8a6e253e1b2db2e64
SHA256:	05c1d10a8d9dd898f7e601a6032284814a640f5fa44e5fc380c17cbbe8940cd5
SHA512:	a7cd7b50bd2d61d84de86f6b20d654271dee18b41212c337a5fac6f1119800d507d0301f5b277e5f73c5135e4a409a0d6f37b858ab7c623ccad1ec3cb645ac05
SSDEEP:	1536:pEyhsbhpFI+TiqWLYSWLC1G2+FBQZEhi:p81/I+TMLYWs2+FBOE
TLSH:	24E35A427F88CC02DA761EFC89A9D6052BA17E252D52C29734B4F35FDBF23D12D08266
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......X.........."...................... ........@.. ..............................4.....`................................

File Icon


Icon Hash:	1733334b12725084

Static PE Info

General

Entrypoint:	0x40ac8e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x589516DB [Fri Feb 3 23:48:43 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	03/02/2017 00:00:00 02/02/2019 23:59:59
Subject Chain	CN=Michael Gillespie, O=Michael Gillespie, POBox=61701, STREET=1201 W. Mill, L=Bloomington, S=Illinois, PostalCode=61701, C=US
Version:	3
Thumbprint MD5:	480439E4F9700E6AF3FEE9045C0B1A9B
Thumbprint SHA-1:	3D9C456DA847F4EE640BAB501878523CF489C39E
Thumbprint SHA-256:	5676FD435A970BDD6ACCA6ECCE204AC432DA8655B7B5B7A61F3D7B0369EEBBB8
Serial:	00E6ADECD3E5B97C6E052F8F8B2CE88C3D

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac34	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x19a38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x22e00	0x1cf0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x26000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8c94	0x8e00	ad84659eb809350cf5ee69568e5a36e5	False	0.8634738116197183	data	7.62629055697075	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x19a38	0x19c00	6625a392659991eebfa4b1f030c30071	False	0.07970835861650485	data	2.007278149984262	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x26000	0xc	0x200	758714ab684a7f517b5df2253d7989e0	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.2154255319148936
RT_ICON	0xc688	0xd2a	PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced	0.9617210682492582
RT_ICON	0xd3b4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.0716804979253112
RT_ICON	0xf95c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.10436210131332083
RT_ICON	0x10a04	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.028628889151780433
RT_ICON	0x2122c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.053200283419933866
RT_GROUP_ICON	0x25454	0x5a	data	0.7555555555555555
RT_VERSION	0x254b0	0x398	OpenPGP Public Key	0.40543478260869564
RT_MANIFEST	0x25848	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: AlphaDecrypter.exePID: 6876, Parent PID: 2580

General

Target ID:	0
Start time:	01:16:10
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\AlphaDecrypter.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AlphaDecrypter.exe"
Imagebase:	0xfe0000
File size:	150'256 bytes
MD5 hash:	61F559E667A8A8BAA99AA9D81D2AFBC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Ransom_Alpha, Description: Regla para detectar Ransom.Alpha (posibles falsos positivos), Source: 00000000.00000002.3034885955.0000000005846000.00000004.08000000.00040000.00000000.sdmp, Author: CCN-CERT Rule: Ransom_Alpha, Description: Regla para detectar Ransom.Alpha (posibles falsos positivos), Source: 00000000.00000002.3033498403.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, Author: CCN-CERT Rule: Ransom_Alpha, Description: Regla para detectar Ransom.Alpha (posibles falsos positivos), Source: 00000000.00000002.3033902968.0000000003318000.00000004.00000800.00020000.00000000.sdmp, Author: CCN-CERT
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: AlphaDecrypter.exePID: 6876, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	4

Executed Functions

Function 01660868 Relevance: 3.1, Strings: 2, Instructions: 637
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 01660F9B
Te^q, xrefs: 01661039

Memory Dump Source

Source File: 00000000.00000002.3033478383.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1660000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID: Te^q$Te^q
API String ID: 0-3743469327
Opcode ID: 23d5ca219bcf39b7f35d72d570c411cdaf105110250d62abf00d5ccfcb5d0298
Instruction ID: 27152e201b54aba267f19eddb6bf81b4f4cf6fb121ad7a7e84b779a6ecb3dca0
Opcode Fuzzy Hash: 23d5ca219bcf39b7f35d72d570c411cdaf105110250d62abf00d5ccfcb5d0298
Instruction Fuzzy Hash: 2F423631E001199FCB54CFADD8849AEBBB6BF89300F558569F819AB365C730EC42CB91

Function 0A11B518 Relevance: 1.8, Strings: 1, Instructions: 514COMMON

Download Yara Rule

Strings

!;#, xrefs: 0A11B54E

Memory Dump Source

Source File: 00000000.00000002.3037643862.000000000A110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a110000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID: !;#
API String ID: 0-2861042907
Opcode ID: bcd47a9bde7cda9b0d6ea1d28e24a3918b1df0863cd54848728bcb8177ad5700
Instruction ID: c36e3242f552afa1368e9c281cb4d87104943e3517630769ef25ad3e59685669
Opcode Fuzzy Hash: bcd47a9bde7cda9b0d6ea1d28e24a3918b1df0863cd54848728bcb8177ad5700
Instruction Fuzzy Hash: 98324835904619CFCB25DF64C984BD9B7F2FF89300F1585E9E809AB261EB71AA85CF40

Function 0A11A6D0 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037643862.000000000A110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a110000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f6d8d468c25230c779726cc55a46f86aa366105d3db5d5f2ecc1b5cb98305e
Instruction ID: 338f143e33c1d2710cac014f7c6b921ed91dfe7473b0d13899bb1d1cfa95442b
Opcode Fuzzy Hash: 16f6d8d468c25230c779726cc55a46f86aa366105d3db5d5f2ecc1b5cb98305e
Instruction Fuzzy Hash: D3526A35911619DFCB25DF64C880AE9BBB1FF49340F1585E9E449AB261EB31EAC2CF40

Function 016614E2 Relevance: .6, Instructions: 630COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033478383.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1660000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8295fd502f6cfa8cc375aa08758b49468ee699c2edc3b4058a52f1bebf7e5019
Instruction ID: c594c1e3deb7bc9a458bc65794bf91426b17508924c7f5c3445f8d1f0daa6ff5
Opcode Fuzzy Hash: 8295fd502f6cfa8cc375aa08758b49468ee699c2edc3b4058a52f1bebf7e5019
Instruction Fuzzy Hash: 5A527A74A00605CFCB15CF58C9849AEBBF6FF89310B2A8A69D456AB355D730F846CF90

Function 0166F620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0166F69E
GetCurrentThread.KERNEL32 ref: 0166F6DB
GetCurrentProcess.KERNEL32 ref: 0166F718
GetCurrentThreadId.KERNEL32 ref: 0166F771

Strings

!;#, xrefs: 0166F63C

Memory Dump Source

Source File: 00000000.00000002.3033478383.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1660000_AlphaDecrypter.jbxd

Similarity

API ID: Current$ProcessThread
String ID: !;#
API String ID: 2063062207-2861042907
Opcode ID: ae1d3cf29fca70b1a377ee79170e8dfd6d42240c275355c70fc5e0ed7f4a0a3d
Instruction ID: 0f52a34c2d2b4b0749c040086981499f8dfaf9196c09ae4e1b5cc27dbdf4fe8b
Opcode Fuzzy Hash: ae1d3cf29fca70b1a377ee79170e8dfd6d42240c275355c70fc5e0ed7f4a0a3d
Instruction Fuzzy Hash: 1D5147B09102098FDB14CFA9E948BAEBFF5FF48314F208469E419A7360DB349985CF65

Function 0166790C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016679C9

Strings

!;#, xrefs: 0166794C

Memory Dump Source

Source File: 00000000.00000002.3033478383.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1660000_AlphaDecrypter.jbxd

Similarity

API ID: Create
String ID: !;#
API String ID: 2289755597-2861042907
Opcode ID: ff4878bf25943ab98f18869d5b6ea4575e2d7854eb642b655213cdc8eeabdd62
Instruction ID: 9c03c9858b745bf86b48881ed6b604e1e3a7748517d0616a31bee3ed4995b7d8
Opcode Fuzzy Hash: ff4878bf25943ab98f18869d5b6ea4575e2d7854eb642b655213cdc8eeabdd62
Instruction Fuzzy Hash: 0B41E2B0C00719CEDB24CFA9C844BCEBBF5BF48308F24816AD408AB255DB755986CF90

Function 0166646C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016679C9

Strings

!;#, xrefs: 0166794C

Memory Dump Source

Source File: 00000000.00000002.3033478383.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1660000_AlphaDecrypter.jbxd

Similarity

API ID: Create
String ID: !;#
API String ID: 2289755597-2861042907
Opcode ID: 1e9a9fad76f0f43ece26e774c92c9b266a0114d3bc075465f0152fee7a7db616
Instruction ID: b09092a8c54297a68ed1cf4319659ea7b67fd73e3eceac481453cd523ddb9adf
Opcode Fuzzy Hash: 1e9a9fad76f0f43ece26e774c92c9b266a0114d3bc075465f0152fee7a7db616
Instruction Fuzzy Hash: FA41C1B0C0071DDBDB24DFA9C844B9EBBF5BF48308F24816AD408AB255DB756945CF90

Function 0166F868 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0166F8EF

Strings

!;#, xrefs: 0166F887

Memory Dump Source

Source File: 00000000.00000002.3033478383.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1660000_AlphaDecrypter.jbxd

Similarity

API ID: DuplicateHandle
String ID: !;#
API String ID: 3793708945-2861042907
Opcode ID: e567a5a45722cfe3ca140a55ed40ab734f0a1d0e1aee9856115b5ca0da42ea7b
Instruction ID: b7dde72c7bb596388835ad8ee942d85a5d2e6d23d76ee1b6d4318ded6c99a121
Opcode Fuzzy Hash: e567a5a45722cfe3ca140a55ed40ab734f0a1d0e1aee9856115b5ca0da42ea7b
Instruction Fuzzy Hash: 7B21E4B5D002589FDB10CF9AD984ADEBFF8FB48310F14845AE914A3310D374A954CFA4

Function 0166D578 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0166D5DE

Strings

!;#, xrefs: 0166D597

Memory Dump Source

Source File: 00000000.00000002.3033478383.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1660000_AlphaDecrypter.jbxd

Similarity

API ID: HandleModule
String ID: !;#
API String ID: 4139908857-2861042907
Opcode ID: c8f4fbfdcf56c811f1da2c012916e26fd85acd7bf02a0c60170c8c1eb43151cb
Instruction ID: e9bb73500268cf0cd1c3c1dd5946f80a3f8a7bf6bc3f151e820b7f317e826d48
Opcode Fuzzy Hash: c8f4fbfdcf56c811f1da2c012916e26fd85acd7bf02a0c60170c8c1eb43151cb
Instruction Fuzzy Hash: 2A1110B5D002498FDB10CF9AC844ADEFBF8AB88324F10842AD869A7610D375A545CFA1

Function 0154D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033117893.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c355b6ee2cb420e7b75a0d70d3bf5fc2c7ad0f229530427d71f6c0cc7cea90
Instruction ID: 66569b888b756832e19c32c2231f1121db5974fe60eb6b77ba8f88d25fa87d38
Opcode Fuzzy Hash: d3c355b6ee2cb420e7b75a0d70d3bf5fc2c7ad0f229530427d71f6c0cc7cea90
Instruction Fuzzy Hash: EB214571500200DFDB05DF58C9C0B6ABFB5FBA8328F20C56DE9090F25AC37AE456CAA1

Function 0154D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033117893.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7265e9ed2f9e5f36fe46def7fddce9ef97a982c4a7fdfd0902fcd4c8194a722a
Instruction ID: 202b4970524d0c0fadc485d66d299a560ebd867b51f2e4c62764f6ffaff2bc4c
Opcode Fuzzy Hash: 7265e9ed2f9e5f36fe46def7fddce9ef97a982c4a7fdfd0902fcd4c8194a722a
Instruction Fuzzy Hash: B2210071600240DFDB05DF58D9C0B6ABFB5FBA831CF20C669E9094F25AC736D456CAA2

Function 015ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033262170.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a623a336e53ca1e716349d161cd8ccc818f75b7c910b7cf7fc8c703bd8d0d7
Instruction ID: 229e1e58534fc43a5691f11dbe20dadf5c6892678ba01baeea269dcd479dbe09
Opcode Fuzzy Hash: 44a623a336e53ca1e716349d161cd8ccc818f75b7c910b7cf7fc8c703bd8d0d7
Instruction Fuzzy Hash: 0F210071A04200DFCB19DF58D988B2ABFF5FB84314F28C969D80A4F256D33AD446CA61

Function 015ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033262170.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6428ec5b9f6846f36be8f9a902f921bc5b5894ae9cfc13cdb039d0cb98307ff
Instruction ID: c019297017bbe0e2b46b7f3fc742cd01e60653d686fb9792b9c55b888201bd51
Opcode Fuzzy Hash: e6428ec5b9f6846f36be8f9a902f921bc5b5894ae9cfc13cdb039d0cb98307ff
Instruction Fuzzy Hash: C8210775904200DFDB09DF98D5C8B2ABBF5FB84324F20C9ADD9494F296C33AD446CA61

Function 015ED2D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033262170.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bfe1365334ff1862eae8b1e69f7234ab0710e80fdf9258c148c8c2e33d9f14
Instruction ID: 4b1756fa9f6f0ddc989a9d3a59140890c4890614072ce43070eacf179085ac47
Opcode Fuzzy Hash: f4bfe1365334ff1862eae8b1e69f7234ab0710e80fdf9258c148c8c2e33d9f14
Instruction Fuzzy Hash: 46212675904200DFDB09DF58D5C8B2EBBF5FB88324F24CA69D8494F246C33AD446C6A1

Function 015ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033262170.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdc5a824239b9923495965f02a2e176570f9fee3bb4052382dcda8c21f9d12b
Instruction ID: 6f0424496060c4706102e01591a8a5aecba412e0d2977a4b18cbe2d1a7bbf707
Opcode Fuzzy Hash: 9bdc5a824239b9923495965f02a2e176570f9fee3bb4052382dcda8c21f9d12b
Instruction Fuzzy Hash: 69219F755093808FDB07CF24D994715BFB1FB46214F28C5EAD8498F2A7C33A980ACB62

Function 0154D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033117893.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 478d2beca2383007fe13e7f2049c16d4f3d9b82d30ca13f9c9486cfcebbfaeff
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: EC11DF76404240CFDB02CF54D5C4B5ABF71FB94328F24C2A9D9090F256C33AE45ACBA1

Function 0154D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033117893.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: aeeecc561b938a3bd4d62aed1bd439bff2c1b0f30534f5c778e5624f403df045
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 0211E172504280CFCB02CF54D5C4B5ABF71FB94318F24C6A9D8090F256C33AD45ACBA1

Function 015ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033262170.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a570c9cd2bee0fa4d5ae8d94bbd9a5307726d85d150342f19139aa2894bfdb13
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: FE118B75904280DFDB16CF54D5C8B19BFB1FB84224F24C6AAD8494F696C33AD44ACB61

Function 015ED2CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3033262170.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 1080a755d4c6bc9a67a368e09ece4b05e4a5afda7f30d10201b1f329612f2b82
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 94119076904280DFDB16CF14D5C4B1AFFB1FB88324F24C6AAD8494B656C33AD40ACBA1

Non-executed Functions

Function 0A11D359 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 0A11D3B5
GetKeyState.USER32(00000002), ref: 0A11D3FA
GetKeyState.USER32(00000004), ref: 0A11D43F
GetKeyState.USER32(00000005), ref: 0A11D484
GetKeyState.USER32(00000006), ref: 0A11D4C9

Strings

!;#, xrefs: 0A11D37F

Memory Dump Source

Source File: 00000000.00000002.3037643862.000000000A110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a110000_AlphaDecrypter.jbxd

Similarity

API ID: State
String ID: !;#
API String ID: 1649606143-2861042907
Opcode ID: 66fb044e9610c74d8129196526b68b42998d66bb314e5fe36ad0d532d676f15f
Instruction ID: 56e969ab7cbe0673517ccbbd7e0d475f2be4bce62c48e409606c338ceef6628c
Opcode Fuzzy Hash: 66fb044e9610c74d8129196526b68b42998d66bb314e5fe36ad0d532d676f15f
Instruction Fuzzy Hash: 6E4194B0D11745DEDB11CF59D5897AFBFF4AB04708F20846AD048A7A90C77CA185CF95

Function 0A110670 Relevance: 1.9, Strings: 1, Instructions: 693COMMON

Download Yara Rule

Strings

fff?, xrefs: 0A110CD7

Memory Dump Source

Source File: 00000000.00000002.3037643862.000000000A110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a110000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 85ee7bc7f4f8f592efa3ba834262de9e2d9c6459e34abfcfb26d7f081fe37dff
Instruction ID: 5f7a821a5ab9f4db18e0ffdf041e4a41f658700abea7981312b3930af0ea5489
Opcode Fuzzy Hash: 85ee7bc7f4f8f592efa3ba834262de9e2d9c6459e34abfcfb26d7f081fe37dff
Instruction Fuzzy Hash: 6F62283681061ADFCF11DF60C884AD9BBB2FF99304F1586D5E9086B125EB71AAD5CF80

Function 0A110667 Relevance: 1.7, Strings: 1, Instructions: 452COMMON

Download Yara Rule

Strings

fff?, xrefs: 0A110CD7

Memory Dump Source

Source File: 00000000.00000002.3037643862.000000000A110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a110000_AlphaDecrypter.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 24d21513579f4092e9c730f5e297397ef8f5b5cee39f2882b45657ba4d89d822
Instruction ID: 8f6f1e0f63dfa9945c18f53ab8b1213c808181a726269926f9253194e038dade
Opcode Fuzzy Hash: 24d21513579f4092e9c730f5e297397ef8f5b5cee39f2882b45657ba4d89d822
Instruction Fuzzy Hash: C712293580065ADFCF11DF50C884AD9BBB2FF49304F1585E5E9086F266DB72AA96CF80

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AlphaDecrypter.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: AlphaDecrypter.exePID: 6876, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: AlphaDecrypter.exePID: 6876, Parent PID: 2580COMMON

Execution Graph

Graph

Windows Analysis Report
AlphaDecrypter.exe

Function 01660868 Relevance: 3.1, Strings: 2, Instructions: 637
COMMON

Function 0166F620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Function 0166790C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 98
COMMON

Function 0166646C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Function 0166F868 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Function 0166D578 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON