top title background image
flash

Rechung-R1663322504.exe

Status: finished
Submission Time: 2023-03-18 05:25:09 +01:00
Malicious
Trojan
Evader
Spyware
GuLoader

Comments

Tags

  • DEU
  • exe
  • geo
  • signed
  • SnakeKeylogger

Details

  • Analysis ID:
    829392
  • API (Web) ID:
    1196495
  • Analysis Started:
    2023-03-18 05:25:10 +01:00
  • Analysis Finished:
    2023-03-18 05:46:15 +01:00
  • MD5:
    11b5b208de7a85b46104a0597c5da7dc
  • SHA1:
    c578bc317e666159cbfc191cb4e50de2de03ab79
  • SHA256:
    0a80ba418f561098477e18cc42ddfc31796b2be3166ff6c99967b98388fe4826
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 60
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 100
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301

Third Party Analysis Engines

malicious
Score: 26/69
malicious
Score: 12/39

IPs

IP Country Detection
158.101.44.242
United States
172.217.16.129
United States
142.250.184.206
United States

Domains

Name IP Detection
checkip.dyndns.com
158.101.44.242
checkip.dyndns.org
0.0.0.0
drive.google.com
142.250.184.206
Click to see the 2 hidden entries
googlehosted.l.googleusercontent.com
172.217.16.129
doc-04-c4-docs.googleusercontent.com
0.0.0.0

URLs

Name Detection
http://checkip.dyndns.org/
http://crl.certum.pl/ctnca2.crl0l
http://crl.micros
Click to see the 20 hidden entries
http://james.newtonking.com/projects/json
http://www.certum.pl/CPS0
http://go.microsoft.LinkId=42127
https://doc-04-c4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v7891419i1as1r1dl2nqlomasvu/1679114250000/12853136832670220481/*/1RhzoPq21Mbz1UprqcH2DXnwFIoRgz7-l?e=download&uuid=687b7ba6-caf7-4f82-8267-8cb96e77380a
http://nsis.sf.net/NSIS_ErrorError
http://checkip.dyndns.org
http://upx.sf.net
http://go.microsoft.
https://support.google.com/chrome/?p=plugin_flash
http://repository.certum.pl/ctnca2.cer09
https://doc-04-c4-docs.googleusercontent.com/
http://subca.ocsp-certum.com01
http://subca.ocsp-certum.com02
https://drive.google.com/
http://subca.ocsp-certum.com05
http://crl.certum.pl/ctnca.crl0k
http://repository.certum.pl/ctsca2021.cer0
https://doc-04-c4-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/eu361v78
http://repository.certum.pl/ctnca.cer09
http://crl.certum.pl/ctsca2021.crl0o

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_caspol.exe_5cc44e97acf31afa8e5c5ec1af53c5acde2c3_00000000_24c613c7-d23f-4749-9f08-829cc3a3e2d7\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E03.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E62.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
Click to see the 12 hidden entries
C:\Users\user\AppData\Local\Temp\nsiF853.tmp\AdvSplash.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\nsiF853.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\Separationerne.lnk
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
#
C:\Users\user\Socialdirektrer\Fornices\Vingummis\Flannelled\Yndighed\Adventure_20.bmp
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, components 3
#
C:\Users\user\Socialdirektrer\Fornices\Vingummis\Flannelled\Yndighed\Dialektforskningen134.Luk
ASCII text, with very long lines (35012), with no line terminators
#
C:\Users\user\Socialdirektrer\Vandspildets.Shi37
data
#
C:\Users\user\Socialdirektrer\media-floppy-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\Socialdirektrer\mk.txt
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
#
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
#
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
MS Windows registry file, NT/2000 or above
#
C:\Windows\assembly\Desktop.ini
Windows desktop.ini
#
\Device\ConDrv
ASCII text
#