Edit tour

Windows Analysis Report
gRo3W1D3VU.exe

Overview

General Information

Sample Name:	gRo3W1D3VU.exe
Original Sample Name:	159be70701e7fe1d7d41ae092f1892f87d0cc615c829b16aa78a333e6a7aa923.exe
Analysis ID:	1287047
MD5:	99ca96aad19f9b58bfaa026e8b3e40da
SHA1:	11bfab7bc400bbeaec6a46eacbcdbcd490dd4640
SHA256:	159be70701e7fe1d7d41ae092f1892f87d0cc615c829b16aa78a333e6a7aa923
Tags:	exe
Infos:

Detection

Customer Loader

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Yara detected Customer Loader

C2 URLs / IPs found in malware configuration

Sample uses string decryption to hide its real strings

.NET source code contains potential unpacker

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

May sleep (evasive loops) to hinder dynamic analysis

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64

gRo3W1D3VU.exe (PID: 7508 cmdline: C:\Users\user\Desktop\gRo3W1D3VU.exe MD5: 99CA96AAD19F9B58BFAA026E8B3E40DA)

cleanup

Malware Configuration

Threatname: Customer Loader

{"C2 url": "https://kyliansuperm92139124.shop/customer/914"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: gRo3W1D3VU.exe PID: 7508	JoeSecurity_CustomerLoader	Yara detected Customer Loader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: gRo3W1D3VU.exe

Malware Configuration Extractor: Customer Loader {"C2 url": "https://kyliansuperm92139124.shop/customer/914"}

Multi AV Scanner detection for submitted file

Source: gRo3W1D3VU.exe	Virustotal: Detection: 50%			Perma Link
Source: gRo3W1D3VU.exe	ReversingLabs: Detection: 50%

Antivirus detection for URL or domain

Source: https://kyliansuperm92139124.shop/customer/914	Avira URL Cloud: Label: malware
Source: https://kyliansuperm92139124.shop	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: kyliansuperm92139124.shop	Virustotal: Detection: 17%	Perma Link
Source: https://kyliansuperm92139124.shop	Virustotal: Detection: 11%	Perma Link
Source: https://kyliansuperm92139124.shop/customer/914	Virustotal: Detection: 20%	Perma Link

Sample uses string decryption to hide its real strings

Source: gRo3W1D3VU.exe	String decryptor: VirtualProtect
Source: gRo3W1D3VU.exe	String decryptor: amsi.dll
Source: gRo3W1D3VU.exe	String decryptor: AmsiScanBuffer
Source: gRo3W1D3VU.exe	String decryptor: https://kyliansuperm92139124.shop/customer/914
Source: gRo3W1D3VU.exe	String decryptor: !!!(.*?)!!!

Source: gRo3W1D3VU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://kyliansuperm92139124.shop/customer/914

Source: unknown

DNS traffic detected: query: kyliansuperm92139124.shop replaycode: Server failure (2)

Source: gRo3W1D3VU.exe, 00000000.00000002.368434168.0000016E64249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gRo3W1D3VU.exe, 00000000.00000002.368434168.0000016E64249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kyliansuperm92139124.shop
Source: gRo3W1D3VU.exe, 00000000.00000002.368434168.0000016E641D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kyliansuperm92139124.shop/customer/914
Source: gRo3W1D3VU.exe, 00000000.00000002.368434168.0000016E64256000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kyliansuperm92139124.shopx

Source: unknown

DNS traffic detected: queries for: kyliansuperm92139124.shop

Source: gRo3W1D3VU.exe

Static PE information: No import functions for PE file found

Source: gRo3W1D3VU.exe	Binary or memory string: OriginalFilename vs gRo3W1D3VU.exe
Source: gRo3W1D3VU.exe, 00000000.00000002.368211617.0000016E62432000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs gRo3W1D3VU.exe
Source: gRo3W1D3VU.exe, 00000000.00000002.368233230.0000016E625E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs gRo3W1D3VU.exe
Source: gRo3W1D3VU.exe	Binary or memory string: OriginalFilename vs gRo3W1D3VU.exe

Source: gRo3W1D3VU.exe	Virustotal: Detection: 50%
Source: gRo3W1D3VU.exe	ReversingLabs: Detection: 50%

Source: gRo3W1D3VU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: gRo3W1D3VU.exe, .cs

Base64 encoded string: 'mQ/DK6Sa9sDTlXe4IA2CbdDNyPolTdFsIZKsK+9E84ic4hIGDN9u4sAlXAikHcB6'

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gRo3W1D3VU.exe.log

Jump to behavior

Source: classification engine

Classification label: mal92.troj.evad.winEXE@1/1@3/0

Source: gRo3W1D3VU.exe, .cs	Cryptographic APIs: 'CreateDecryptor'
Source: gRo3W1D3VU.exe, .cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: gRo3W1D3VU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gRo3W1D3VU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected Customer Loader

Source: Yara match

File source: Process Memory Space: gRo3W1D3VU.exe PID: 7508, type: MEMORYSTR

.NET source code contains potential unpacker

Source: gRo3W1D3VU.exe, .cs

.Net Code: System.AppDomain.Load(byte[])

Source: gRo3W1D3VU.exe

Static PE information: real checksum: 0xffb5 should be: 0x2a65

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe TID: 7540	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\gRo3W1D3VU.exe TID: 7532	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: gRo3W1D3VU.exe, 00000000.00000002.368334749.0000016E62692000.00000004.00000020.00020000.00000000.sdmp, gRo3W1D3VU.exe, 00000000.00000003.368035080.0000016E62691000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgg

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Queries volume information: C:\Users\user\Desktop\gRo3W1D3VU.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\gRo3W1D3VU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Non-Application Layer Protocol	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gRo3W1D3VU.exe	51%	Virustotal		Browse
gRo3W1D3VU.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
kyliansuperm92139124.shop	18%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://kyliansuperm92139124.shop/customer/914	100%	Avira URL Cloud	malware
https://kyliansuperm92139124.shopx	0%	Avira URL Cloud	safe
https://kyliansuperm92139124.shop	100%	Avira URL Cloud	phishing
https://kyliansuperm92139124.shop	11%	Virustotal		Browse
https://kyliansuperm92139124.shop/customer/914	20%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kyliansuperm92139124.shop	unknown	unknown	true	18%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://kyliansuperm92139124.shop/customer/914	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://kyliansuperm92139124.shop	gRo3W1D3VU.exe, 00000000.00000002.368434168.0000016E64249000.00000004.00000800.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://kyliansuperm92139124.shopx	gRo3W1D3VU.exe, 00000000.00000002.368434168.0000016E64256000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	gRo3W1D3VU.exe, 00000000.00000002.368434168.0000016E64249000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1287047
Start date and time:	2023-08-07 13:29:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	gRo3W1D3VU.exe
Original Sample Name:	159be70701e7fe1d7d41ae092f1892f87d0cc615c829b16aa78a333e6a7aa923.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@1/1@3/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 80% Number of executed functions: 9 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Execution Graph export aborted for target gRo3W1D3VU.exe, PID 7508 because it is empty
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:30:07	API Interceptor	1x Sleep call for process: gRo3W1D3VU.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gRo3W1D3VU.exe.log

Download File

Process:	C:\Users\user\Desktop\gRo3W1D3VU.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.367899416177239
Encrypted:	false
SSDEEP:	24:ML9E4KrL1qE4GiD0E4KeGiKDE4KGKN08AKhPKIE4TKD1KoZAE4KKPz:MxHKn1qHGiD0HKeGiYHKGD8AoPtHTG1Q
MD5:	7115A3215A4C22EF20AB9AF4160EE8F5
SHA1:	A4CAB34355971C1FBAABECEFA91458C4936F2C24
SHA-256:	A4A689E8149166591F94A8C84E99BE744992B9E80BDB7A0713453EB6C59BBBB2
SHA-512:	2CEF2BCD284265B147ABF300A4D26AD1AAC743EFE0B47A394FB614B6843A60B9F918E56261A56334078D0D9681132F3403FB734EE66E1915CF76F29411D5CE20
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.490603300851477
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gRo3W1D3VU.exe
File size:	10'752 bytes
MD5:	99ca96aad19f9b58bfaa026e8b3e40da
SHA1:	11bfab7bc400bbeaec6a46eacbcdbcd490dd4640
SHA256:	159be70701e7fe1d7d41ae092f1892f87d0cc615c829b16aa78a333e6a7aa923
SHA512:	7267e98d590a906653216f92bc46dd598d54cf8fac2a74ccdda1bf4130d9f7d52a2c0e899cc434978ea0d188f486dfcef1b1ccb695640d2805300dae171e51a8
SSDEEP:	192:xSHXwiZU4+PVsBdlCnnV87Mf7Fhqg9QblGr3bzssFssq:MHVU4kVs3UnoezTyl+vssFssq
TLSH:	4F221A088BFC111BE59B97BCDDB302821275AA7B3543EF2B9A9C91C90C613D06F91376
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....i.d.........."...0.................. ....@...... .......................`............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64AA69BF [Sun Jul 9 08:03:11 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x788	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2600	0x1758	.text
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1e88	0x2000	False	0.5687255859375	data	5.671244000096234	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x788	0x800	False	0.31298828125	data	4.6088024886109595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_GROUP_ICON	0x40b8	0x6	data			1.8333333333333333
RT_VERSION	0x40c0	0x364	data			0.6232718894009217
RT_VERSION	0x4424	0x364	data	English	United States	0.6255760368663594

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 7, 2023 13:30:01.858216047 CEST	57990	53	192.168.2.3	8.8.8.8
Aug 7, 2023 13:30:02.888842106 CEST	57990	53	192.168.2.3	8.8.8.8
Aug 7, 2023 13:30:03.933128119 CEST	57990	53	192.168.2.3	8.8.8.8
Aug 7, 2023 13:30:05.899796009 CEST	53	57990	8.8.8.8	192.168.2.3
Aug 7, 2023 13:30:06.932257891 CEST	53	57990	8.8.8.8	192.168.2.3
Aug 7, 2023 13:30:08.000737906 CEST	53	57990	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 7, 2023 13:30:06.932440996 CEST	192.168.2.3	8.8.8.8	cffc	(Port unreachable)	Destination Unreachable
Aug 7, 2023 13:30:08.000837088 CEST	192.168.2.3	8.8.8.8	cffc	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 7, 2023 13:30:01.858216047 CEST	192.168.2.3	8.8.8.8	0x4bd1	Standard query (0)	kyliansuperm92139124.shop	A (IP address)	IN (0x0001)	false
Aug 7, 2023 13:30:02.888842106 CEST	192.168.2.3	8.8.8.8	0x4bd1	Standard query (0)	kyliansuperm92139124.shop	A (IP address)	IN (0x0001)	false
Aug 7, 2023 13:30:03.933128119 CEST	192.168.2.3	8.8.8.8	0x4bd1	Standard query (0)	kyliansuperm92139124.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 7, 2023 13:30:05.899796009 CEST	8.8.8.8	192.168.2.3	0x4bd1	Server failure (2)	kyliansuperm92139124.shop	none	none	A (IP address)	IN (0x0001)	false
Aug 7, 2023 13:30:06.932257891 CEST	8.8.8.8	192.168.2.3	0x4bd1	Server failure (2)	kyliansuperm92139124.shop	none	none	A (IP address)	IN (0x0001)	false
Aug 7, 2023 13:30:08.000737906 CEST	8.8.8.8	192.168.2.3	0x4bd1	Server failure (2)	kyliansuperm92139124.shop	none	none	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: gRo3W1D3VU.exePID: 7508, Parent PID: 3452

General

Target ID:	0
Start time:	13:30:00
Start date:	07/08/2023
Path:	C:\Users\user\Desktop\gRo3W1D3VU.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\gRo3W1D3VU.exe
Imagebase:	0x16e62430000
File size:	10'752 bytes
MD5 hash:	99CA96AAD19F9B58BFAA026E8B3E40DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: gRo3W1D3VU.exePID: 7508, Parent PID: 3452COMMON

Executed Functions

Function 00007FFBAC180995 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

#=a_^, xrefs: 00007FFBAC1809CB

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID: #=a_^
API String ID: 0-863911569
Opcode ID: f42928a97fecce7114afc1f62e01ed060f5a7806fafbc49adce538a6551cc1bd
Instruction ID: 741005f924314f4edcdaa5dd8787ff643f4ff6067cff426a1a638f8ddc632548
Opcode Fuzzy Hash: f42928a97fecce7114afc1f62e01ed060f5a7806fafbc49adce538a6551cc1bd
Instruction Fuzzy Hash: 1B51E2F2A0EA8E4FE7AB9634C8491B477E1EF85314F0401BAD88DC72D2D93DA8068755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1812A4 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e270404c1043a82cb9c2d274b5ea3e85d79410b967d694f105b55e89ac591b
Instruction ID: dddc81724a12f02bdab95340188c17c78d9013e582b64a99c4ec09c64040d5a6
Opcode Fuzzy Hash: b5e270404c1043a82cb9c2d274b5ea3e85d79410b967d694f105b55e89ac591b
Instruction Fuzzy Hash: 3241577161894E8FDB89EF28C455AE973E2FF58300B5045B8D41EC7696CE35EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC180C4E Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04d64a20df71dd639c15584eefd294317edd8e6d412c76e2c334e4b63cb367d
Instruction ID: de97088d7488798f064e41a05dfdbfa492484927910bc1fd647698a7fe523adf
Opcode Fuzzy Hash: a04d64a20df71dd639c15584eefd294317edd8e6d412c76e2c334e4b63cb367d
Instruction Fuzzy Hash: B7315270A08A4E8FDF85DF58C894AEA77F1FF98310F104569D819D7295CB35E852CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC18145D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc40005847ad17cdc44b1ce9363da772a57f5d7fdb0f637bceeaa5e5df9749d
Instruction ID: 503ff0765f2ca6a9c203e090b002472ac30258c0bd9b9b9d6204ff6be4dfca06
Opcode Fuzzy Hash: 8bc40005847ad17cdc44b1ce9363da772a57f5d7fdb0f637bceeaa5e5df9749d
Instruction Fuzzy Hash: B121A1A294E7D20FE35387B498696A07FE0DF5312071D41EBD486CB4A3DA1C884AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC180491 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40eeb0df1e8b3c7f289dcdd4f11b5c2b4e47e519fc1194f1c9842ff9fb5e49c7
Instruction ID: c2995bcdd0cc3b08f712ca186440f2eeda5d2855621dd29a22a287670dc2fca1
Opcode Fuzzy Hash: 40eeb0df1e8b3c7f289dcdd4f11b5c2b4e47e519fc1194f1c9842ff9fb5e49c7
Instruction Fuzzy Hash: 8811B2B1C0D28D8FDB06AB7084551EA7FB0AF12314F4400FED086D61A3DA7C4549CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1810B9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9318914b5bb1d09e3fcf24138b7bf1fcbbf6db8aee05f2da4a793b24e8e56ab4
Instruction ID: c9259bbe8d968ccec2ecd4959fd56831aa661303581e79bd156159ccdc3d8612
Opcode Fuzzy Hash: 9318914b5bb1d09e3fcf24138b7bf1fcbbf6db8aee05f2da4a793b24e8e56ab4
Instruction Fuzzy Hash: EC01807170C9894FC785EB6CD869A447BE1FF99311B5A01E6E009CB2A3DA24DC41C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC181001 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82c690fdaea42c9c8272f078de4a3a78af804b7d6eccb158d65eeecf92d5b1f
Instruction ID: dc7e6f225ab09da422dac9081e5247851485e544acfdc8be8c83607d57629766
Opcode Fuzzy Hash: a82c690fdaea42c9c8272f078de4a3a78af804b7d6eccb158d65eeecf92d5b1f
Instruction Fuzzy Hash: EBF08B81A1E6CA0FD307EBB458292F47BD0AF46160F0900FAC44DC71A3DC1CDD4547A6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC181505 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb4cf13003857d075f21a109987434dfe6043c52c7906e16f8fb4ae266e2ac8
Instruction ID: 5480f678f0522b564ec381fd01f45f135c8ff7eb0b7da96ede13a72bb899b44a
Opcode Fuzzy Hash: 6eb4cf13003857d075f21a109987434dfe6043c52c7906e16f8fb4ae266e2ac8
Instruction Fuzzy Hash: 75E02231A1C91C8FC794EA2CA8996A037E1FF6832038A01E7E008C726BEA14DC428380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC180480 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.368701532.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac180000_gRo3W1D3VU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e5cc00ff44d70a6635e96beb5c9a85846535719aaca59b67d04633853b5050
Instruction ID: 8756ab6c7d59d772fa8f513115969d49cc5fea161d2daf573b4aff21f5291037
Opcode Fuzzy Hash: 81e5cc00ff44d70a6635e96beb5c9a85846535719aaca59b67d04633853b5050
Instruction Fuzzy Hash: 86A00284D9B80E01D80B31BA9D8B09674506B8A924FC51560EC1980186E89E95E90397

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gRo3W1D3VU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Customer Loader

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gRo3W1D3VU.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
gRo3W1D3VU.exe