Windows Analysis Report
Gun Ici Cek Statu Listesi.exe

Overview

General Information

Sample name: Gun Ici Cek Statu Listesi.exe
Analysis ID: 1545932
MD5: 3dc6111263e1e236519080dbea81c1f1
SHA1: 1600ba53fdd878a0d93e7eaabec5b82558c8d6f2
SHA256: 29ce0132efcb5e1aad146065672d83b6b4ced076f1c91a851c8b34a30e7e08eb
Tags: exeuser-lowmal3
Infos:

Detection

MassLogger RAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected MassLogger RAT
Yara detected Telegram RAT
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

AV Detection
barindex
Found malware configuration
Source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "kingnovasend@zqamcx.com", "Password": "Anambraeast", "Server": "zqamcx.com", "To": "kingnovaresult@zqamcx.com", "Port": 587}
Multi AV Scanner detection for submitted file
Source: Gun Ici Cek Statu Listesi.exe ReversingLabs: Detection: 34%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Gun Ici Cek Statu Listesi.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses 32bit PE files
Source: Gun Ici Cek Statu Listesi.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49710 version: TLS 1.0
Source: Gun Ici Cek Statu Listesi.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ZvRY.pdb source: Gun Ici Cek Statu Listesi.exe
Source: Binary string: ZvRY.pdbSHA256 source: Gun Ici Cek Statu Listesi.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 053C5782h 9_2_053C5366
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 053C51B9h 9_2_053C4F08
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 053C5782h 9_2_053C56AF
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06751935h 9_2_067515F8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675F8D8h 9_2_0675F630
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675A0C0h 9_2_06759E18
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675A970h 9_2_0675A6C8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675D93Ah 9_2_0675D690
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675B220h 9_2_0675AF78
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 067531F0h 9_2_06752F48
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06753AA0h 9_2_067537F8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06753EF8h 9_2_06753C50
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675DEC8h 9_2_0675DC20
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675E778h 9_2_0675E4D0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06750741h 9_2_06750498
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675BF28h 9_2_0675BC80
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06750FF1h 9_2_06750D48
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675C7D8h 9_2_0675C530
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675D088h 9_2_0675CDE0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675F028h 9_2_0675ED80
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675A518h 9_2_0675A270
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675D4E0h 9_2_0675D238
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06752D98h 9_2_06752AF0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675FD30h 9_2_0675FA88
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675ADC8h 9_2_0675AB20
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675B678h 9_2_0675B3D0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06753648h 9_2_067533A0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675E320h 9_2_0675E078
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 067502E9h 9_2_06750040
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675BAD0h 9_2_0675B828
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06750B99h 9_2_067508F0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675C380h 9_2_0675C0D8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06754350h 9_2_067540A8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675EBD0h 9_2_0675E928
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675F480h 9_2_0675F1D8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 06751449h 9_2_067511A0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4x nop then jmp 0675CC30h 9_2_0675C988
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 158.101.44.242 158.101.44.242
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49708 -> 158.101.44.242:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49710 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.77 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.comd
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F29000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/d
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.orgd
Source: Gun Ici Cek Statu Listesi.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Gun Ici Cek Statu Listesi.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Gun Ici Cek Statu Listesi.exe String found in binary or memory: http://ocsp.comodoca.com0
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F5B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F5B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.orgd
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1298701357.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Gun Ici Cek Statu Listesi.exe String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.77d
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.77l
Source: Gun Ici Cek Statu Listesi.exe String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, UltraSpeed.cs .Net Code: VKCodeToUnicode
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, UltraSpeed.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7964, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Detected potential crypto function
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_01204204 4_2_01204204
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_0120E134 4_2_0120E134
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_01207018 4_2_01207018
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_07770E28 4_2_07770E28
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_0777A5C8 4_2_0777A5C8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_0777B270 4_2_0777B270
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_077730D0 4_2_077730D0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_07773F77 4_2_07773F77
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_07773F88 4_2_07773F88
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_0777AE38 4_2_0777AE38
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_07770E27 4_2_07770E27
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_07773CF0 4_2_07773CF0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_07773CEB 4_2_07773CEB
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_0777AA00 4_2_0777AA00
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 4_2_0777C978 4_2_0777C978
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053C27B9 9_2_053C27B9
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053CC168 9_2_053CC168
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053C4F08 9_2_053C4F08
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053C7E68 9_2_053C7E68
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053CCA58 9_2_053CCA58
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053C2DD1 9_2_053C2DD1
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053C7E59 9_2_053C7E59
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053C4EF8 9_2_053C4EF8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053CB9E0 9_2_053CB9E0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06757770 9_2_06757770
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06751C58 9_2_06751C58
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06754500 9_2_06754500
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067515F8 9_2_067515F8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06756998 9_2_06756998
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675F630 9_2_0675F630
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675F620 9_2_0675F620
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06759E18 9_2_06759E18
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675A6C8 9_2_0675A6C8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675A6B9 9_2_0675A6B9
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675D690 9_2_0675D690
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675D683 9_2_0675D683
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675AF78 9_2_0675AF78
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675AF68 9_2_0675AF68
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06752F48 9_2_06752F48
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06752F38 9_2_06752F38
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067537F8 9_2_067537F8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067537E8 9_2_067537E8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675BC71 9_2_0675BC71
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06753C50 9_2_06753C50
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06753C43 9_2_06753C43
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675DC20 9_2_0675DC20
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675DC13 9_2_0675DC13
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675E4D0 9_2_0675E4D0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675E4C0 9_2_0675E4C0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06759C90 9_2_06759C90
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06750498 9_2_06750498
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675BC80 9_2_0675BC80
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06750489 9_2_06750489
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675ED70 9_2_0675ED70
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06750D48 9_2_06750D48
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675C530 9_2_0675C530
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06750D39 9_2_06750D39
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675C520 9_2_0675C520
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675CDE0 9_2_0675CDE0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067515E9 9_2_067515E9
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675CDD0 9_2_0675CDD0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675ED80 9_2_0675ED80
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675A270 9_2_0675A270
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675FA78 9_2_0675FA78
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675A261 9_2_0675A261
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675D235 9_2_0675D235
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675D238 9_2_0675D238
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06752AF0 9_2_06752AF0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06752AE0 9_2_06752AE0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675FA88 9_2_0675FA88
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675AB20 9_2_0675AB20
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675AB10 9_2_0675AB10
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675B3D0 9_2_0675B3D0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675B3C1 9_2_0675B3C1
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067533A0 9_2_067533A0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06753393 9_2_06753393
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675E078 9_2_0675E078
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675E068 9_2_0675E068
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06750040 9_2_06750040
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675B828 9_2_0675B828
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675001F 9_2_0675001F
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675B818 9_2_0675B818
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06750007 9_2_06750007
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067508F0 9_2_067508F0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067508DF 9_2_067508DF
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675C0D8 9_2_0675C0D8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675C0CB 9_2_0675C0CB
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067540A8 9_2_067540A8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_06754098 9_2_06754098
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675C97B 9_2_0675C97B
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675E923 9_2_0675E923
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675E928 9_2_0675E928
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675F1D8 9_2_0675F1D8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675F1C8 9_2_0675F1C8
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_067511A0 9_2_067511A0
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675118F 9_2_0675118F
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_0675C988 9_2_0675C988
PE / OLE file has an invalid certificate
Source: Gun Ici Cek Statu Listesi.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000000.1277508725.0000000000B7E000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenameZvRY.exe: vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCloudServices.exe< vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1298701357.00000000031E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCloudServices.exe< vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1297342715.000000000125E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1307079322.000000000B860000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2538708730.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2538399423.000000000041A000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCloudServices.exe< vs Gun Ici Cek Statu Listesi.exe
Source: Gun Ici Cek Statu Listesi.exe Binary or memory string: OriginalFilenameZvRY.exe: vs Gun Ici Cek Statu Listesi.exe
Uses 32bit PE files
Source: Gun Ici Cek Statu Listesi.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7964, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Gun Ici Cek Statu Listesi.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, UltraSpeed.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, COVIDPickers.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, UltraSpeed.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, COVIDPickers.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, BHbhGjLmSJtKoaQuHX.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: _0020.SetAccessControl
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: _0020.AddAccessRule
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, BHbhGjLmSJtKoaQuHX.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, BHbhGjLmSJtKoaQuHX.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: _0020.SetAccessControl
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: _0020.AddAccessRule
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: _0020.SetAccessControl
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, oxKxmVMjJtO0UCCOse.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/6@2/2
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Gun Ici Cek Statu Listesi.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44kxd1iw.rn2.ps1 Jump to behavior
Source: Gun Ici Cek Statu Listesi.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Gun Ici Cek Statu Listesi.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2541549233.0000000003EED000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002F9E000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp, Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2540599838.0000000002FDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Gun Ici Cek Statu Listesi.exe ReversingLabs: Detection: 34%
Source: unknown Process created: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe"
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe"
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Gun Ici Cek Statu Listesi.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Gun Ici Cek Statu Listesi.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Gun Ici Cek Statu Listesi.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: ZvRY.pdb source: Gun Ici Cek Statu Listesi.exe
Source: Binary string: ZvRY.pdbSHA256 source: Gun Ici Cek Statu Listesi.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 4.2.Gun Ici Cek Statu Listesi.exe.59d0000.4.raw.unpack, XlF5VlCIHRSQX8M5eh.cs .Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, oxKxmVMjJtO0UCCOse.cs .Net Code: CP5JbSSsFD System.Reflection.Assembly.Load(byte[])
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, oxKxmVMjJtO0UCCOse.cs .Net Code: CP5JbSSsFD System.Reflection.Assembly.Load(byte[])
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, oxKxmVMjJtO0UCCOse.cs .Net Code: CP5JbSSsFD System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053CF273 push ebp; retf 9_2_053CF281
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053CF28A push ebp; retf 9_2_053CF281
Source: Gun Ici Cek Statu Listesi.exe Static PE information: section name: .text entropy: 7.541144126728436
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, BHbhGjLmSJtKoaQuHX.cs High entropy of concatenated method names: 'r8fGUT9kn5', 'lOrGHWaPFv', 'RpTGR2FCBQ', 'P76GKHpmcB', 'BebGcyK81R', 'RrSG406FFa', 'r5ZGAx97Aj', 'THjG56PAKp', 'wLTGId7y4Z', 'h9UGyP859j'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, YNK0gSXHitc3DiiOQT.cs High entropy of concatenated method names: 'osabY8hpV', 'CCE8JOJ9s', 'Y2vOKEcFS', 'OO69kDiR0', 'yXRiUxS7L', 'S0bwILHuL', 'WA4r6FbCOyTRoUxMxt', 'hRwBEUjpyfK5gFrBsp', 'eFTHBd9X1CMgTKofV0', 'Bu4jengNX'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, rLXZpdDEdib8vQIyKsy.cs High entropy of concatenated method names: 'qQk0rCXEDx', 'zwh0QLMhtX', 'zWJ0bAuEBe', 'pW6082J9nO', 'iqH0FxmAZ0', 'h0m0O5YJZL', 'udC09jav1C', 'E8x0LMOhMy', 'SYM0iZkGIv', 'PLd0wQAOvC'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, oxKxmVMjJtO0UCCOse.cs High entropy of concatenated method names: 'lPZphrlvSI', 'MXSpfmj4oh', 'YV0pGeVa2Q', 'HOAp1Joegd', 'dE7p3IayEr', 'Ja6pknmQWf', 'U4JpuVafH2', 'TEEpM83Ge4', 'C8UpnQTYiK', 'o51pg62ZhK'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, RmGyf8vYshlwKxAfwM.cs High entropy of concatenated method names: 'n3wkhRKWDO', 'bSFkGi3TWf', 'IZZk3sGX02', 'xBWkutN85h', 'yVPkMmMGIW', 'pb03cMAE1G', 'A8t34SJPcy', 'Cy93AsuXDl', 'qdF35ZffFP', 'gOP3IssAQk'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, SIY3pWDpBTJGhHlx7n6.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EQTlUBoA0c', 'WGPlH1WDcG', 'vaslRNSVZG', 'rhklKuKT53', 'yHSlcRbDI7', 'b5Rl4AJ1hR', 'FxBlARR0wb'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, CfUkf8ZWLbwau4ucyj.cs High entropy of concatenated method names: 'Xg9CL0k6IK', 'd47Ci3WIcS', 'lw1CvlmoEO', 'w1BC2XAGty', 'kWdCofk7FN', 'OWhCTsj2jx', 'lKgCdVakZN', 'NkWCSZ4ssA', 'OPpCYgbiyA', 'UVbCN2G3rE'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, VbkOTMJXvhlvWVGDll.cs High entropy of concatenated method names: 'JbFDuHbhGj', 'PSJDMtKoaQ', 'fFsDgrMVn1', 'WpGDxJVewn', 'Jm5DB7PHmG', 'Yf8DeYshlw', 'DmIxYsejKh1DVFJlPm', 'zqc1jSo2sjFOyhmqL2', 'x5NDD9y48x', 'wf5DpA4YlN'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, htSaWt5ptmfiRHxRLr.cs High entropy of concatenated method names: 'aoXjfEw3fi', 'sMTjGRjhcH', 'IQhj1CDOpi', 'KoRj3S4vhb', 'oWWjk6to0H', 'U8lju14scb', 'rcVjMA2e1K', 'rF0jnwmHQU', 'vnrjgxicu9', 'DfjjxkEaDO'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, XrUYSpUOTux5TTa8y5.cs High entropy of concatenated method names: 'q0TBYPZ3YS', 'Ta4BmSYQbU', 'qG1BUqr9Q0', 'EKxBHFAyVM', 'TTRB2IpwOn', 'tY7BtCHtei', 'tj2Bom16dN', 'jXGBT3s0nE', 'YhZBVn7dQk', 'PLsBd3uARj'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, bqXXAPKlXsJjRpfmsw.cs High entropy of concatenated method names: 'HfOsg0KEK7', 'PGesxp2BG7', 'ToString', 'BNqsfSkQ5F', 'TEOsGeFEDR', 'YxSs1BMjNO', 'MYMs3jnQD8', 'SjKskt71VC', 'KJHsusxMln', 'NRIsMP9ULC'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, Kewnb3wCYwrqnTm57P.cs High entropy of concatenated method names: 'CKl3F79odf', 'Mfe39ykJok', 'hfp1tp6oDm', 'ysA1o4COVe', 'ghI1TwIY4P', 'uA91V2o7St', 'h1X1dxJtIZ', 'rca1SkVta0', 'fes1ai48mW', 'bK01Y51lLB'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, fJ8Y4p2jQGqHOitbj1.cs High entropy of concatenated method names: 'FG3vL5gEM8TUQKYdmuq', 'b4h95ngsVomH8V80cOJ', 'JV0kjdeuep', 'OGDk0iFcAR', 'TSBklQxHL6', 'nuvri5g2pFLR97PBZV0', 'sQ3RZTgMTLCkpUWUT8O'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, mmZBJFz6nWeF9HnCdW.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'A9h0CEAncx', 'd0r0BjNoT6', 'eZB0e3rXwm', 'QxF0snkB1e', 'tsG0jdCcX6', 'gN100OWDwB', 'Aw10lCWGHe'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, H2lqbed8SFN1g9tDVl.cs High entropy of concatenated method names: 'R9qufRxaUZ', 'OqGu12Rj4M', 'pVIukFL3wT', 'b8WkyqqgaM', 'fbukzf29vx', 'S2UuEdfiEA', 'T0SuD1nHlM', 'cTAuXMsesd', 'E5wupKGAkl', 'UqduJ5yaBj'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, TNU3G7GxC1YUXl7GSf.cs High entropy of concatenated method names: 'Dispose', 'drDDIv8fYx', 'WY4X2cgdg4', 'WKM66tdAGT', 'w3tDySaWtp', 'ImfDziRHxR', 'ProcessDialogKey', 'DrCXEW5fqv', 'TxXXDMb9hP', 'AGXXXKEqQd'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, TEqQdGyBlCnR99T6Fe.cs High entropy of concatenated method names: 'O0j0DKIwui', 'OEn0p5iGym', 'z3N0JhuB8a', 'kBS0fYIX1x', 'fXw0GNOiHF', 'tbx03rpVFY', 'h2X0kc9hDK', 'mw6jAZDQU3', 'IAWj5ZHtwC', 'TdOjI22hSX'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, XudE7JaZHelNtQqltN.cs High entropy of concatenated method names: 'kV1urAlWsG', 'T26uQJslqH', 'InUub7Alre', 'S4Ju8m9lwC', 'GSUuFVgS2D', 'HdluOBFhuJ', 'iX2u9Iw9Ol', 'h9MuLJLBMh', 'BkwuijSNN2', 'aghuw40Wgx'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, iSuJs84oOaOfRl5axG.cs High entropy of concatenated method names: 'SXis5V7rhe', 'mOfsysBW6y', 'm76jEPwXT6', 'IRXjDr3X0C', 'cWwsNXiW8U', 'oRKsm5uF30', 'joqsZCni7O', 'JEOsUwLsi0', 'QDmsHhEwmC', 'eWXsRPQHyU'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, vAMMDfiFsrMVn1ApGJ.cs High entropy of concatenated method names: 'bYe18dLKaZ', 'G1K1OdPK1h', 'Dtw1LsScdh', 'Bv61iVqlPQ', 'B071BAZMU5', 'bQt1etNfsn', 'GWt1srIdBF', 'EDD1jvgQ4n', 'uCQ106e6un', 'FaH1lUHrha'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, BHbhGjLmSJtKoaQuHX.cs High entropy of concatenated method names: 'r8fGUT9kn5', 'lOrGHWaPFv', 'RpTGR2FCBQ', 'P76GKHpmcB', 'BebGcyK81R', 'RrSG406FFa', 'r5ZGAx97Aj', 'THjG56PAKp', 'wLTGId7y4Z', 'h9UGyP859j'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, YNK0gSXHitc3DiiOQT.cs High entropy of concatenated method names: 'osabY8hpV', 'CCE8JOJ9s', 'Y2vOKEcFS', 'OO69kDiR0', 'yXRiUxS7L', 'S0bwILHuL', 'WA4r6FbCOyTRoUxMxt', 'hRwBEUjpyfK5gFrBsp', 'eFTHBd9X1CMgTKofV0', 'Bu4jengNX'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, rLXZpdDEdib8vQIyKsy.cs High entropy of concatenated method names: 'qQk0rCXEDx', 'zwh0QLMhtX', 'zWJ0bAuEBe', 'pW6082J9nO', 'iqH0FxmAZ0', 'h0m0O5YJZL', 'udC09jav1C', 'E8x0LMOhMy', 'SYM0iZkGIv', 'PLd0wQAOvC'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, oxKxmVMjJtO0UCCOse.cs High entropy of concatenated method names: 'lPZphrlvSI', 'MXSpfmj4oh', 'YV0pGeVa2Q', 'HOAp1Joegd', 'dE7p3IayEr', 'Ja6pknmQWf', 'U4JpuVafH2', 'TEEpM83Ge4', 'C8UpnQTYiK', 'o51pg62ZhK'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, RmGyf8vYshlwKxAfwM.cs High entropy of concatenated method names: 'n3wkhRKWDO', 'bSFkGi3TWf', 'IZZk3sGX02', 'xBWkutN85h', 'yVPkMmMGIW', 'pb03cMAE1G', 'A8t34SJPcy', 'Cy93AsuXDl', 'qdF35ZffFP', 'gOP3IssAQk'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, SIY3pWDpBTJGhHlx7n6.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EQTlUBoA0c', 'WGPlH1WDcG', 'vaslRNSVZG', 'rhklKuKT53', 'yHSlcRbDI7', 'b5Rl4AJ1hR', 'FxBlARR0wb'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, CfUkf8ZWLbwau4ucyj.cs High entropy of concatenated method names: 'Xg9CL0k6IK', 'd47Ci3WIcS', 'lw1CvlmoEO', 'w1BC2XAGty', 'kWdCofk7FN', 'OWhCTsj2jx', 'lKgCdVakZN', 'NkWCSZ4ssA', 'OPpCYgbiyA', 'UVbCN2G3rE'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, VbkOTMJXvhlvWVGDll.cs High entropy of concatenated method names: 'JbFDuHbhGj', 'PSJDMtKoaQ', 'fFsDgrMVn1', 'WpGDxJVewn', 'Jm5DB7PHmG', 'Yf8DeYshlw', 'DmIxYsejKh1DVFJlPm', 'zqc1jSo2sjFOyhmqL2', 'x5NDD9y48x', 'wf5DpA4YlN'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, htSaWt5ptmfiRHxRLr.cs High entropy of concatenated method names: 'aoXjfEw3fi', 'sMTjGRjhcH', 'IQhj1CDOpi', 'KoRj3S4vhb', 'oWWjk6to0H', 'U8lju14scb', 'rcVjMA2e1K', 'rF0jnwmHQU', 'vnrjgxicu9', 'DfjjxkEaDO'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, XrUYSpUOTux5TTa8y5.cs High entropy of concatenated method names: 'q0TBYPZ3YS', 'Ta4BmSYQbU', 'qG1BUqr9Q0', 'EKxBHFAyVM', 'TTRB2IpwOn', 'tY7BtCHtei', 'tj2Bom16dN', 'jXGBT3s0nE', 'YhZBVn7dQk', 'PLsBd3uARj'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, bqXXAPKlXsJjRpfmsw.cs High entropy of concatenated method names: 'HfOsg0KEK7', 'PGesxp2BG7', 'ToString', 'BNqsfSkQ5F', 'TEOsGeFEDR', 'YxSs1BMjNO', 'MYMs3jnQD8', 'SjKskt71VC', 'KJHsusxMln', 'NRIsMP9ULC'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, Kewnb3wCYwrqnTm57P.cs High entropy of concatenated method names: 'CKl3F79odf', 'Mfe39ykJok', 'hfp1tp6oDm', 'ysA1o4COVe', 'ghI1TwIY4P', 'uA91V2o7St', 'h1X1dxJtIZ', 'rca1SkVta0', 'fes1ai48mW', 'bK01Y51lLB'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, fJ8Y4p2jQGqHOitbj1.cs High entropy of concatenated method names: 'FG3vL5gEM8TUQKYdmuq', 'b4h95ngsVomH8V80cOJ', 'JV0kjdeuep', 'OGDk0iFcAR', 'TSBklQxHL6', 'nuvri5g2pFLR97PBZV0', 'sQ3RZTgMTLCkpUWUT8O'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, mmZBJFz6nWeF9HnCdW.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'A9h0CEAncx', 'd0r0BjNoT6', 'eZB0e3rXwm', 'QxF0snkB1e', 'tsG0jdCcX6', 'gN100OWDwB', 'Aw10lCWGHe'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, H2lqbed8SFN1g9tDVl.cs High entropy of concatenated method names: 'R9qufRxaUZ', 'OqGu12Rj4M', 'pVIukFL3wT', 'b8WkyqqgaM', 'fbukzf29vx', 'S2UuEdfiEA', 'T0SuD1nHlM', 'cTAuXMsesd', 'E5wupKGAkl', 'UqduJ5yaBj'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, TNU3G7GxC1YUXl7GSf.cs High entropy of concatenated method names: 'Dispose', 'drDDIv8fYx', 'WY4X2cgdg4', 'WKM66tdAGT', 'w3tDySaWtp', 'ImfDziRHxR', 'ProcessDialogKey', 'DrCXEW5fqv', 'TxXXDMb9hP', 'AGXXXKEqQd'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, TEqQdGyBlCnR99T6Fe.cs High entropy of concatenated method names: 'O0j0DKIwui', 'OEn0p5iGym', 'z3N0JhuB8a', 'kBS0fYIX1x', 'fXw0GNOiHF', 'tbx03rpVFY', 'h2X0kc9hDK', 'mw6jAZDQU3', 'IAWj5ZHtwC', 'TdOjI22hSX'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, XudE7JaZHelNtQqltN.cs High entropy of concatenated method names: 'kV1urAlWsG', 'T26uQJslqH', 'InUub7Alre', 'S4Ju8m9lwC', 'GSUuFVgS2D', 'HdluOBFhuJ', 'iX2u9Iw9Ol', 'h9MuLJLBMh', 'BkwuijSNN2', 'aghuw40Wgx'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, iSuJs84oOaOfRl5axG.cs High entropy of concatenated method names: 'SXis5V7rhe', 'mOfsysBW6y', 'm76jEPwXT6', 'IRXjDr3X0C', 'cWwsNXiW8U', 'oRKsm5uF30', 'joqsZCni7O', 'JEOsUwLsi0', 'QDmsHhEwmC', 'eWXsRPQHyU'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, vAMMDfiFsrMVn1ApGJ.cs High entropy of concatenated method names: 'bYe18dLKaZ', 'G1K1OdPK1h', 'Dtw1LsScdh', 'Bv61iVqlPQ', 'B071BAZMU5', 'bQt1etNfsn', 'GWt1srIdBF', 'EDD1jvgQ4n', 'uCQ106e6un', 'FaH1lUHrha'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, BHbhGjLmSJtKoaQuHX.cs High entropy of concatenated method names: 'r8fGUT9kn5', 'lOrGHWaPFv', 'RpTGR2FCBQ', 'P76GKHpmcB', 'BebGcyK81R', 'RrSG406FFa', 'r5ZGAx97Aj', 'THjG56PAKp', 'wLTGId7y4Z', 'h9UGyP859j'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, YNK0gSXHitc3DiiOQT.cs High entropy of concatenated method names: 'osabY8hpV', 'CCE8JOJ9s', 'Y2vOKEcFS', 'OO69kDiR0', 'yXRiUxS7L', 'S0bwILHuL', 'WA4r6FbCOyTRoUxMxt', 'hRwBEUjpyfK5gFrBsp', 'eFTHBd9X1CMgTKofV0', 'Bu4jengNX'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, rLXZpdDEdib8vQIyKsy.cs High entropy of concatenated method names: 'qQk0rCXEDx', 'zwh0QLMhtX', 'zWJ0bAuEBe', 'pW6082J9nO', 'iqH0FxmAZ0', 'h0m0O5YJZL', 'udC09jav1C', 'E8x0LMOhMy', 'SYM0iZkGIv', 'PLd0wQAOvC'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, oxKxmVMjJtO0UCCOse.cs High entropy of concatenated method names: 'lPZphrlvSI', 'MXSpfmj4oh', 'YV0pGeVa2Q', 'HOAp1Joegd', 'dE7p3IayEr', 'Ja6pknmQWf', 'U4JpuVafH2', 'TEEpM83Ge4', 'C8UpnQTYiK', 'o51pg62ZhK'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, RmGyf8vYshlwKxAfwM.cs High entropy of concatenated method names: 'n3wkhRKWDO', 'bSFkGi3TWf', 'IZZk3sGX02', 'xBWkutN85h', 'yVPkMmMGIW', 'pb03cMAE1G', 'A8t34SJPcy', 'Cy93AsuXDl', 'qdF35ZffFP', 'gOP3IssAQk'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, SIY3pWDpBTJGhHlx7n6.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EQTlUBoA0c', 'WGPlH1WDcG', 'vaslRNSVZG', 'rhklKuKT53', 'yHSlcRbDI7', 'b5Rl4AJ1hR', 'FxBlARR0wb'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, CfUkf8ZWLbwau4ucyj.cs High entropy of concatenated method names: 'Xg9CL0k6IK', 'd47Ci3WIcS', 'lw1CvlmoEO', 'w1BC2XAGty', 'kWdCofk7FN', 'OWhCTsj2jx', 'lKgCdVakZN', 'NkWCSZ4ssA', 'OPpCYgbiyA', 'UVbCN2G3rE'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, VbkOTMJXvhlvWVGDll.cs High entropy of concatenated method names: 'JbFDuHbhGj', 'PSJDMtKoaQ', 'fFsDgrMVn1', 'WpGDxJVewn', 'Jm5DB7PHmG', 'Yf8DeYshlw', 'DmIxYsejKh1DVFJlPm', 'zqc1jSo2sjFOyhmqL2', 'x5NDD9y48x', 'wf5DpA4YlN'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, htSaWt5ptmfiRHxRLr.cs High entropy of concatenated method names: 'aoXjfEw3fi', 'sMTjGRjhcH', 'IQhj1CDOpi', 'KoRj3S4vhb', 'oWWjk6to0H', 'U8lju14scb', 'rcVjMA2e1K', 'rF0jnwmHQU', 'vnrjgxicu9', 'DfjjxkEaDO'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, XrUYSpUOTux5TTa8y5.cs High entropy of concatenated method names: 'q0TBYPZ3YS', 'Ta4BmSYQbU', 'qG1BUqr9Q0', 'EKxBHFAyVM', 'TTRB2IpwOn', 'tY7BtCHtei', 'tj2Bom16dN', 'jXGBT3s0nE', 'YhZBVn7dQk', 'PLsBd3uARj'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, bqXXAPKlXsJjRpfmsw.cs High entropy of concatenated method names: 'HfOsg0KEK7', 'PGesxp2BG7', 'ToString', 'BNqsfSkQ5F', 'TEOsGeFEDR', 'YxSs1BMjNO', 'MYMs3jnQD8', 'SjKskt71VC', 'KJHsusxMln', 'NRIsMP9ULC'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, Kewnb3wCYwrqnTm57P.cs High entropy of concatenated method names: 'CKl3F79odf', 'Mfe39ykJok', 'hfp1tp6oDm', 'ysA1o4COVe', 'ghI1TwIY4P', 'uA91V2o7St', 'h1X1dxJtIZ', 'rca1SkVta0', 'fes1ai48mW', 'bK01Y51lLB'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, fJ8Y4p2jQGqHOitbj1.cs High entropy of concatenated method names: 'FG3vL5gEM8TUQKYdmuq', 'b4h95ngsVomH8V80cOJ', 'JV0kjdeuep', 'OGDk0iFcAR', 'TSBklQxHL6', 'nuvri5g2pFLR97PBZV0', 'sQ3RZTgMTLCkpUWUT8O'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, mmZBJFz6nWeF9HnCdW.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'A9h0CEAncx', 'd0r0BjNoT6', 'eZB0e3rXwm', 'QxF0snkB1e', 'tsG0jdCcX6', 'gN100OWDwB', 'Aw10lCWGHe'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, H2lqbed8SFN1g9tDVl.cs High entropy of concatenated method names: 'R9qufRxaUZ', 'OqGu12Rj4M', 'pVIukFL3wT', 'b8WkyqqgaM', 'fbukzf29vx', 'S2UuEdfiEA', 'T0SuD1nHlM', 'cTAuXMsesd', 'E5wupKGAkl', 'UqduJ5yaBj'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, TNU3G7GxC1YUXl7GSf.cs High entropy of concatenated method names: 'Dispose', 'drDDIv8fYx', 'WY4X2cgdg4', 'WKM66tdAGT', 'w3tDySaWtp', 'ImfDziRHxR', 'ProcessDialogKey', 'DrCXEW5fqv', 'TxXXDMb9hP', 'AGXXXKEqQd'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, TEqQdGyBlCnR99T6Fe.cs High entropy of concatenated method names: 'O0j0DKIwui', 'OEn0p5iGym', 'z3N0JhuB8a', 'kBS0fYIX1x', 'fXw0GNOiHF', 'tbx03rpVFY', 'h2X0kc9hDK', 'mw6jAZDQU3', 'IAWj5ZHtwC', 'TdOjI22hSX'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, XudE7JaZHelNtQqltN.cs High entropy of concatenated method names: 'kV1urAlWsG', 'T26uQJslqH', 'InUub7Alre', 'S4Ju8m9lwC', 'GSUuFVgS2D', 'HdluOBFhuJ', 'iX2u9Iw9Ol', 'h9MuLJLBMh', 'BkwuijSNN2', 'aghuw40Wgx'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, iSuJs84oOaOfRl5axG.cs High entropy of concatenated method names: 'SXis5V7rhe', 'mOfsysBW6y', 'm76jEPwXT6', 'IRXjDr3X0C', 'cWwsNXiW8U', 'oRKsm5uF30', 'joqsZCni7O', 'JEOsUwLsi0', 'QDmsHhEwmC', 'eWXsRPQHyU'
Source: 4.2.Gun Ici Cek Statu Listesi.exe.b860000.5.raw.unpack, vAMMDfiFsrMVn1ApGJ.cs High entropy of concatenated method names: 'bYe18dLKaZ', 'G1K1OdPK1h', 'Dtw1LsScdh', 'Bv61iVqlPQ', 'B071BAZMU5', 'bQt1etNfsn', 'GWt1srIdBF', 'EDD1jvgQ4n', 'uCQ106e6un', 'FaH1lUHrha'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: 11E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: 3000000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: 2D50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: 91E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: A1E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: A3F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: B3F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: B8C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: C8C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: D8C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: 2E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: 2EC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: 4EC0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6439 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3315 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe TID: 7776 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8136 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1297342715.0000000001293000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\(
Source: Gun Ici Cek Statu Listesi.exe, 00000004.00000002.1297342715.0000000001293000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}*W
Source: Gun Ici Cek Statu Listesi.exe, 00000009.00000002.2539045169.0000000001222000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Code function: 9_2_053CC168 LdrInitializeThunk,LdrInitializeThunk, 9_2_053CC168
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, UltraSpeed.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe"
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Memory written: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Process created: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe "C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected MassLogger RAT
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7964, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7964, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Gun Ici Cek Statu Listesi.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2540599838.0000000003014000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7964, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected MassLogger RAT
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7964, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Gun Ici Cek Statu Listesi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.403d0f0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.4a27740.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.40262d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Gun Ici Cek Statu Listesi.exe.49ceb20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1300730080.0000000004009000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2538399423.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1300730080.000000000485A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Gun Ici Cek Statu Listesi.exe PID: 7964, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545932 Sample: Gun Ici Cek Statu Listesi.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 100 22 reallyfreegeoip.org 2->22 24 checkip.dyndns.org 2->24 26 checkip.dyndns.com 2->26 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Multi AV Scanner detection for submitted file 2->36 40 10 other signatures 2->40 8 Gun Ici Cek Statu Listesi.exe 4 2->8         started        signatures3 38 Tries to detect the country of the analysis system (by using the IP) 22->38 process4 file5 20 C:\...behaviorgraphun Ici Cek Statu Listesi.exe.log, ASCII 8->20 dropped 42 Adds a directory exclusion to Windows Defender 8->42 44 Injects a PE file into a foreign processes 8->44 12 Gun Ici Cek Statu Listesi.exe 15 2 8->12         started        16 powershell.exe 23 8->16         started        signatures6 process7 dnsIp8 28 reallyfreegeoip.org 188.114.97.3, 443, 49710 CLOUDFLARENETUS European Union 12->28 30 checkip.dyndns.com 158.101.44.242, 49708, 80 ORACLE-BMC-31898US United States 12->30 46 Tries to steal Mail credentials (via file / registry access) 12->46 48 Tries to harvest and steal browser information (history, passwords, etc) 12->48 50 Loading BitLocker PowerShell Module 16->50 18 conhost.exe 16->18         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
158.101.44.242
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
checkip.dyndns.com 158.101.44.242 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
  • URL Reputation: safe
 unknown
https://reallyfreegeoip.org/xml/173.254.250.77 false
    		unknown