Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Unlock_Tool_2.3.1.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.068877902497512
Filename:	Unlock_Tool_2.3.1.exe
Filesize:	617000
MD5:	72162382680c702829c6ceed17d2e507
SHA1:	51324f4095fe73a99d080d9f0bba1c829430bb18
SHA256:	eaae82540ddec53797abee6d3bf507acace850f3fff7cb2a03b6a26ab0b5c46f
SHA512:	27787baedb4fafe7884369d9cafb762aaa540e8130c7acefd618c4fb40e1c3459bcfe94df5f1aadc1245fcb52900692f96200d021f5d3bd6087ab12c3661d397
SSDEEP:	12288:9/kD3wynB4WIz1hhnpF6SnU/wq0vWCfIBM+09d83nEO:SwynIPU/wqsWCfIdm6Xt
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{u.............(h......(h..v...(h......(h..............................................................Rich............PE..L..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
Self deletion via cmd or bat file	Hooking and other Techniques for Hiding and Protection	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Credentials in Registry
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	OS Credential Dumping Data from Local System Ingress Tool Transfer
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings	Windows Management Instrumentation
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to detect sandboxes (mouse cursor move detection)	Malware Analysis System Evasion	Account Discovery System Owner/User Discovery
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Process Discovery Archive Collected Data Encrypted Channel
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
One or more processes crash	System Summary
PE / OLE file has an invalid certificate	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Queries information about the installed CPU (vendor, model number etc)	Language, Device and Operating System Detection	Native API
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Native API Software Packing
Checks the free space of harddrives	Malware Analysis System Evasion
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to instantiate COM classes	System Summary
Contains functionality to modify the execution of threads in other processes
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery System Information Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Found strings which match to known social media urls	Networking
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Queries a list of all running processes	Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Unlock_Tool_2.3._2aeb643dce4cdcbeeaaa9deab94801d87eb2245_2e620264_e4511507-1d45-44dd-b311-3e06606d6c77\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Unlock_Tool_2.3._2aeb643dce4cdcbeeaaa9deab94801d87eb2245_2e620264_e4511507-1d45-44dd-b311-3e06606d6c77\Report.wer
Category:	dropped
Dump:	Report.wer.5.dr
ID:	dr_5
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.6655377807856876
Encrypted:	false
Ssdeep:	96:/ikFm0FsHWZAa7sNhKoI7Rn6tQXIDcQvc6QcEVcw3cE/6uD+HbHg/5hZAX/d5FM4:LcnWua7N0BU/uugjhzuiFjZ24IO8ds
Size:	65536
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER813B.tmp.dmp

Mini DuMP crash report, 14 streams, Sun Oct 20 15:58:59 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER813B.tmp.dmp
Category:	dropped
Dump:	WER813B.tmp.dmp.5.dr
ID:	dr_2
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 15:58:59 2024, 0x1205a4 type
Entropy:	1.707530637222622
Encrypted:	false
Ssdeep:	96:5Q8P3QJKBTaS59+HyjSi77vnbK2Gv5aWV+NklIt3yrKVkjS68LWx4Wqx9avYfCoD:JfQAzAFOC2GxHqko3Zz8P1VEQ
Size:	31998
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8320.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER8320.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER8320.tmp.WERInternalMetadata.xml.5.dr
ID:	dr_3
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.6998131136811434
Encrypted:	false
Ssdeep:	192:R6l7wVeJgL666Y2DxSUUzgmfZppr789bNdsfN7vm:R6lXJs666YMSUogmfZoNWfN6
Size:	8428
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83DD.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER83DD.tmp.xml
Category:	dropped
Dump:	WER83DD.tmp.xml.5.dr
ID:	dr_4
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.497133012266415
Encrypted:	false
Ssdeep:	48:cvIwWl8zspJg77aI9rAWpW8VYPYm8M4Jn7Ft+q8v00MfBzkSeTd:uIjf7I7F57VDJjKr4BzkSGd
Size:	4755
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199786602107[1].htm

HTML document, Unicode text, UTF-8 text, with very long lines (3146), with CRLF, LF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199786602107[1].htm
Category:	dropped
Dump:	76561199786602107[1].htm.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3146), with CRLF, LF line terminators
Entropy:	5.426611821930421
Encrypted:	false
Ssdeep:	768:J7pqLjWYmmwB5DPgqaciNGAnTBv++nIjBtPF5zfukPco1AULTBv++nIjBtPF5x2q:J78LjWYmmwB5DPgqaccnTBv++nIjBtPk
Size:	30851
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Temp\delays.tmp

ISO-8859 text, with very long lines (65536), with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\delays.tmp
Category:	dropped
Dump:	delays.tmp.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Entropy:	0.0
Encrypted:	false
Ssdeep:	3:tctl:Ql
Size:	1048575
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.5.dr
ID:	dr_6
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.468673433098864
Encrypted:	false
Ssdeep:	6144:nzZfpi6ceLPx9skLmb0f3ZWSP3aJG8nAgeiJRMMhA2zX4WABluuN3jDH5S:zZHt3ZWOKnMM6bFpVj4
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

"C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7336
Target ID:	0
Parent PID:	4004
Name:	Unlock_Tool_2.3.1.exe
Path:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Commandline:	"C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"
Size:	617000
MD5:	72162382680C702829C6CEED17D2E507
Time:	11:58:58
Date:	20/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x790000
Modulesize:	626688
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
Yara detected Vidar stealer	Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Self deletion via cmd or bat file	Hooking and other Techniques for Hiding and Protection	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE / OLE file has an invalid certificate	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

"C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7404
Target ID:	2
Parent PID:	7336
Name:	Unlock_Tool_2.3.1.exe
Path:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Commandline:	"C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"
Size:	617000
MD5:	72162382680C702829C6CEED17D2E507
Time:	11:58:58
Date:	20/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x790000
Modulesize:	626688
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
Yara detected Vidar stealer	Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Self deletion via cmd or bat file	Hooking and other Techniques for Hiding and Protection	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE / OLE file has an invalid certificate	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit

Details

Is windows:	true
Is dropped:	false
PID:	5928
Target ID:	15
Parent PID:	7404
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit
Size:	236544
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Time:	11:59:32
Date:	20/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x1c0000
Modulesize:	368640
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Self deletion via cmd or bat file	Hooking and other Techniques for Hiding and Protection	File Deletion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 272

Details

Is windows:	true
Is dropped:	false
PID:	7480
Target ID:	5
Parent PID:	7336
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 272
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	11:58:59
Date:	20/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x450000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	5876
Target ID:	16
Parent PID:	5928
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	11:59:32
Date:	20/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff66e660000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Details

Is windows:	true
Is dropped:	false
PID:	7136
Target ID:	17
Parent PID:	5928
Name:	timeout.exe
Path:	C:\Windows\SysWOW64\timeout.exe
Commandline:	timeout /t 10
Size:	25088
MD5:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Time:	11:59:32
Date:	20/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xc50000
Modulesize:	40960
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://player.vimeo.com

unknown

https://steamcommunity.com/login/home/?goto=profiles%2F76561199786602107

unknown

https://steamcommunity.com/?subsection=broadcasts

unknown

http://cowod.hopto.org

unknown

https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV

unknown

https://store.steampowered.com/subscriber_agreement/

unknown

https://www.gstatic.cn/recaptcha/

unknown

https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=

unknown

https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli

unknown

https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&

unknown

https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&amp

unknown

https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE

unknown

http://www.valvesoftware.com/legal.htm

unknown

https://recaptcha.net/recaptcha/

unknown

https://www.youtube.com

unknown

https://www.google.com

unknown

https://steamcommunity.com/profiles/76561199786602107y

unknown

http://cowod.hopto.org_DEBUG.zip/c

unknown

http://cowod.hopto.orgclass=

unknown

http://cowod.hopto.

unknown

https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

unknown

https://t.me/lpnjokeg0b4cMozilla/5.0

unknown

https://steamcommunity.com/profiles/76561199786602107h

unknown

http://cowod.hopto

unknown

https://community.cloudflare.steamstatic.com/public/css/app

unknown

https://65.109.142.154

unknown

https://s.ytimg.com;

unknown

https://steam.tv/

unknown

https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&

unknown

http://www.entrust.net/rpa03

unknown

https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=4Xou

unknown

https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&

unknown

https://t.me/lpnjoke

149.154.167.99

https://store.steampowered.com/points/shop/

unknown

https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK

unknown

https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp

unknown

https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=D_iTAfDsLH

unknown

https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&

unknown

https://sketchfab.com

unknown

https://lv.queniujq.cn

unknown

https://www.youtube.com/

unknown

https://store.steampowered.com/privacy_agreement/

unknown

https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/

unknown

https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png

unknown

https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v

unknown

https://community.cloudflare.stea

unknown

https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016

unknown

https://www.google.com/recaptcha/

unknown

https://checkout.steampowered.com/

unknown

http://cowod.hoptotml

unknown

https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b

unknown

https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png

unknown

http://crl.entrust.net/2048ca.crl0

unknown

https://store.steampowered.com/;

unknown

https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli

unknown

https://www.entrust.net/rpa0

unknown

https://store.steampowered.com/about/

unknown

http://cowod.hopto.orgsive/header_logo.png

unknown

https://community.cloudflare.steamstatic.com/

unknown

https://steamcommunity.com/my/wishlist/

unknown

https://t.me/

unknown

https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&

unknown

http://ocsp.entrust.net03

unknown

http://ocsp.entrust.net02

unknown

https://help.steampowered.com/en/

unknown

https://steamcommunity.com/market/

unknown

https://store.steampowered.com/news/

unknown

https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0

unknown

https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.

unknown

https://65.109.142.154/0

unknown

https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=

unknown

https://65.109.142.154/%

unknown

https://recaptcha.net/recaptcha/;

unknown

https://steamcommunity.com/discussions/

unknown

http://cowod.hopto.re

unknown

https://store.steampowered.com/stats/

unknown

https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis

unknown

https://medal.tv

unknown

https://broadcast.st.dl.eccdnx.com

unknown

https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp

unknown

https://store.steampowered.com/steam_refunds/

unknown

https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif

unknown

https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v

unknown

https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p

unknown

https://65.109.142.154/L

unknown

https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&

unknown

https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1

unknown

http://crl.entrust.net/ts1ca.crl0

unknown

https://steamcommunity.com/workshop/

unknown

https://login.steampowered.com/

unknown

https://steamcommunity.com/6

unknown

https://community.c

unknown

https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl

unknown

https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=

unknown

https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en

unknown

https://65.109.142.154/U

unknown

http://cowod.hopto.org/

unknown

https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am

unknown

https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli

unknown

https://recaptcha.net

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

steamcommunity.com

104.102.49.254

Details

Name:	steamcommunity.com
IP:	104.102.49.254
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

t.me

149.154.167.99

Details

Name:	t.me
IP:	149.154.167.99
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

cowod.hopto.org

unknown

IPs

Domain

Country

Malicious

104.102.49.254

steamcommunity.com

United States

Details

IP:	104.102.49.254
TargetID:	2
Current Path:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Country:	United States
Countrycode:	USA
ASN number:	16625
ASN name:	AKAMAI-ASUS
Private:	false
Domain:	steamcommunity.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

65.109.142.154

unknown

United States

Details

IP:	65.109.142.154
TargetID:	2
Current Path:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Country:	United States
Countrycode:	USA
ASN number:	11022
ASN name:	ALABANZA-BALTUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

149.154.167.99

t.me

United Kingdom

Details

IP:	149.154.167.99
TargetID:	2
Current Path:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Country:	United Kingdom
Countrycode:	GBR
ASN number:	62041
ASN name:	TELEGRAMRU
Private:	false
Domain:	t.me

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached

{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214EF-0000-0000-C000-000000000046} 0xFFFF

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

ProgramId

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

FileId

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

LowerCaseLongPath

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

LongPathHash

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

Name

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

OriginalFileName

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

Publisher

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

Version

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

BinFileVersion

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

BinaryType

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

ProductName

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

ProductVersion

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

LinkDate

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

BinProductVersion

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

AppxPackageFullName

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

AppxPackageRelativeId

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

Size

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

Language

\REGISTRY\A\{5649b2c9-4045-8242-34a4-8ed490638ca1}\Root\InventoryApplicationFile\unlock_tool_2.3.|5063d7dbcffaeb99

Usn

There are 10 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

7AB000

unkown

page read and write

400000

remote allocation

page execute and read and write

481000

remote allocation

page execute and read and write

10E4000

heap

page read and write

1792D000

heap

page read and write

566000

remote allocation

page execute and read and write

1368000

heap

page read and write

127A000

heap

page read and write

59F000

remote allocation

page execute and read and write

10E4000

heap

page read and write

7AB000

unkown

page write copy

1299000

heap

page read and write

12E5000

heap

page read and write

E8A000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

1315000

heap

page read and write

5C8E000

stack

page read and write

126F000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

529000

remote allocation

page execute and read and write

15300000

heap

page read and write

12A6000

heap

page read and write

107E000

stack

page read and write

12DBB000

stack

page read and write

17B6B000

stack

page read and write

C00000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

17A10000

heap

page read and write

10E4000

heap

page read and write

1DE0B000

stack

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

80D000

unkown

page readonly

80B000

unkown

page execute and read and write

10E4000

heap

page read and write

17966000

heap

page read and write

12EA000

heap

page read and write

10E4000

heap

page read and write

1100000

trusted library allocation

page read and write

10E5000

heap

page read and write

F60000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

C5E000

stack

page read and write

10E4000

heap

page read and write

E8E000

heap

page read and write

12A4000

heap

page read and write

5F9000

remote allocation

page execute and read and write

10E4000

heap

page read and write

790000

unkown

page readonly

670000

remote allocation

page execute and read and write

10E4000

heap

page read and write

472000

remote allocation

page execute and read and write

118E000

stack

page read and write

1286000

heap

page read and write

7A4000

unkown

page readonly

10E4000

heap

page read and write

2C70000

heap

page read and write

10E4000

heap

page read and write

15380000

remote allocation

page read and write

10E4000

heap

page read and write

BBC000

stack

page read and write

585000

remote allocation

page execute and read and write

11DE000

stack

page read and write

10E4000

heap

page read and write

12E1000

heap

page read and write

1793E000

heap

page read and write

10E4000

heap

page read and write

80D000

unkown

page readonly

178FF000

stack

page read and write

10E4000

heap

page read and write

810000

unkown

page write copy

791000

unkown

page execute read

307F000

stack

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

80D000

unkown

page readonly

3188000

heap

page read and write

10E4000

heap

page read and write

C10000

heap

page read and write

1341000

heap

page read and write

790000

unkown

page readonly

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

1796D000

heap

page read and write

12A6000

heap

page read and write

10E4000

heap

page read and write

128C000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

1795F000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

7AB000

unkown

page write copy

55F000

remote allocation

page execute and read and write

EF2000

stack

page read and write

1196000

heap

page read and write

E80000

heap

page read and write

10E4000

heap

page read and write

80D000

unkown

page readonly

17A6C000

stack

page read and write

10E4000

heap

page read and write

1DF4C000

stack

page read and write

65D000

remote allocation

page execute and read and write

12A6000

heap

page read and write

1049F000

stack

page read and write

2DAE000

stack

page read and write

10E4000

heap

page read and write

152FD000

stack

page read and write

10E4000

heap

page read and write

3140000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E0000

heap

page read and write

3180000

heap

page read and write

17BA0000

trusted library allocation

page read and write

10E4000

heap

page read and write

E5F000

stack

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

9EA1000

heap

page read and write

810000

unkown

page write copy

EFD000

stack

page read and write

303E000

stack

page read and write

467000

remote allocation

page execute and read and write

C80000

heap

page read and write

10E4000

heap

page read and write

17C50000

heap

page read and write

BFC000

stack

page read and write

10E4000

heap

page read and write

119E000

heap

page read and write

9EB2000

heap

page read and write

114E000

stack

page read and write

9FA0000

unclassified section

page read and write

17980000

heap

page read and write

BFC000

stack

page read and write

790000

unkown

page readonly

10E4000

heap

page read and write

10E4000

heap

page read and write

10C0000

heap

page read and write

58C000

remote allocation

page execute and read and write

2D60000

heap

page read and write

1291000

heap

page read and write

2DEF000

stack

page read and write

1190000

heap

page read and write

10E4000

heap

page read and write

89C000

stack

page read and write

1308000

heap

page read and write

7A4000

unkown

page readonly

15380000

remote allocation

page read and write

12D7C000

stack

page read and write

10BE000

stack

page read and write

7A4000

unkown

page readonly

10E4000

heap

page read and write

56D000

remote allocation

page execute and read and write

1083D000

stack

page read and write

10E4000

heap

page read and write

80C000

unkown

page read and write

10E4000

heap

page read and write

5D8000

remote allocation

page execute and read and write

10E4000

heap

page read and write

1796A000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

12DE000

heap

page read and write

17964000

heap

page read and write

5AB000

remote allocation

page execute and read and write

9EA1000

heap

page read and write

791000

unkown

page execute read

10E4000

heap

page read and write

10E4000

heap

page read and write

791000

unkown

page execute read

791000

unkown

page execute read

1DF0C000

stack

page read and write

7A4000

unkown

page readonly

17971000

heap

page read and write

99D000

stack

page read and write

810000

unkown

page write copy

12A2000

heap

page read and write

1E04D000

stack

page read and write

17975000

heap

page read and write

153BE000

stack

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

7AB000

unkown

page write copy

10E4000

heap

page read and write

10E4000

heap

page read and write

106EE000

stack

page read and write

81CE000

stack

page read and write

15380000

remote allocation

page read and write

130C000

heap

page read and write

9EA0000

heap

page read and write

574000

remote allocation

page execute and read and write

523000

remote allocation

page execute and read and write

810000

unkown

page write copy

1069F000

stack

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

119C000

heap

page read and write

17912000

heap

page read and write

107EF000

stack

page read and write

2D50000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

1210000

heap

page read and write

463000

remote allocation

page execute and read and write

10BF000

stack

page read and write

10E4000

heap

page read and write

1059F000

stack

page read and write

10E4000

heap

page read and write

12E0000

heap

page read and write

1791C000

heap

page read and write

10E4000

heap

page read and write

1344000

heap

page read and write

1218000

heap

page read and write

12F1000

heap

page read and write

FBE000

stack

page read and write

17BA0000

trusted library allocation

page read and write

790000

unkown

page readonly

125B000

heap

page read and write

10E4000

heap

page read and write

10E4000

heap

page read and write

There are 225 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Unlock_Tool_2.3.1.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportUnlock_Tool_2.3.1.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
Unlock_Tool_2.3.1.exe