flash

SecuriteInfo.com.Win32.CrypterX-gen.22126.16591.exe

Status: finished
Submission Time: 2022-11-29 10:37:21 +01:00
Malicious
Trojan
Spyware
Evader
FormBook

Comments

Tags

  • exe

Details

  • Analysis ID:
    755940
  • API (Web) ID:
    1123215
  • Analysis Started:
    2022-11-29 10:40:48 +01:00
  • Analysis Finished:
    2022-11-29 10:53:15 +01:00
  • MD5:
    55d6460392408d1325c18b69a91c28e3
  • SHA1:
    405847d03be406a0025eda76852dfd46420a8d7a
  • SHA256:
    d1e9780a620ddf149c2aed319388bca7ed690c2a58c9ffc8f60b1c4515115dc9
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
12/41

malicious

IPs

IP Country Detection
103.193.185.8
Hong Kong

Domains

Name IP Detection
www.somethingyourselves.com
103.193.185.8
www.alrt.info
80.92.205.131

URLs

Name Detection
www.madamkikkiey.net/n2hm/
http://www.somethingyourselves.com/n2hm/?bN=9gwJr9Ib0rEc+KDTQOrHkeZIL+750DWB0cIboGlmlHlNjyJ/Euut2Sz1G3s+yPgqLfhiB/VwLZOXrNsbN5gXgWVJl9cnSs3fxA==&TpfpO=3fCD1To0u
http://www.fontbureau.como
Click to see the 40 hidden entries
https://search.yahoo.com?fr=crmas_sfp
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn/cThe
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-user.html
http://www.jiyu-kobo.co.jp/
http://www.typography.netD
http://www.galapagosdesign.com/DPlease
http://www.fontbureau.com/designers8
http://www.fonts.com
http://www.sandoll.co.kr
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.sajatypeworks.come
http://www.sakkal.com
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
https://search.yahoo.com?fr=crmas_sfpf
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.fontbureau.com/designersG
http://www.sajatypeworks.comiv
https://duckduckgo.com/ac/?q=
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
http://www.fontbureau.com/designers?
http://www.founder.com.c
https://ac.ecosia.org/autocomplete?q=
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://www.tiro.com
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
http://www.fontbureau.com/designers
http://www.goodfont.co.kr
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
http://www.carterandcone.coml
http://www.sajatypeworks.com
https://duckduckgo.com/chrome_newtab

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.22126.16591.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmp4724.tmp
XML 1.0 document, ASCII text
#
C:\Users\user\AppData\Roaming\FqJXaFxwEj.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 9 hidden entries
C:\Users\user\AppData\Roaming\FqJXaFxwEj.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FqJXaFxwEj.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\17089-7
SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44oebsyr.ko3.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4searmeq.c02.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ab3likgp.3hk.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kuw1e3h0.ro1.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\tmp8C7A.tmp
XML 1.0 document, ASCII text
#