Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Agent.446.6903.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Agent.446.6903.exe
Analysis ID:	1384466
MD5:	c8b5dcfbdbf417d517edf952f366ef7f
SHA1:	be435b97e7f057d5d82bbed7a01fc857c4bdae75
SHA256:	d4e47ed98b4f06008fddd350f0516a0b2f1f8b1a1bdbb027328aa5b1b00b1893
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Agent.446.6903.exe (PID: 6496 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe MD5: C8B5DCFBDBF417D517EDF952F366EF7F)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.15.156.127:48665"], "Authorization Header": "502b9ebb15fe09bd8cf1ab568d1e9df0"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1887950311.0000000000EA9000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1888124901.0000000000F22000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Agent.446.6903.exe PID: 6496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Agent.446.6903.exe PID: 6496	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.f20000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.e90000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 45.15.156.127 - Destination IP: 192.168.2.4

Timestamp:	45.15.156.127192.168.2.448665497302043234 02/01/24-02:52:04.219457
SID:	2043234
Source Port:	48665
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 45.15.156.127

Timestamp:	192.168.2.445.15.156.12749730486652043231 02/01/24-02:52:19.959258
SID:	2043231
Source Port:	49730
Destination Port:	48665
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 45.15.156.127

Timestamp:	192.168.2.445.15.156.12749730486652046045 02/01/24-02:52:03.983916
SID:	2046045
Source Port:	49730
Destination Port:	48665
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 45.15.156.127 - Destination IP: 192.168.2.4

Timestamp:	45.15.156.127192.168.2.448665497302046056 02/01/24-02:52:10.200070
SID:	2046056
Source Port:	48665
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: 45.15.156.127:48665

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.f20000.2.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["45.15.156.127:48665"], "Authorization Header": "502b9ebb15fe09bd8cf1ab568d1e9df0"}

Multi AV Scanner detection for domain / URL

Source: 45.15.156.127:48665

Virustotal: Detection: 14%

Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Virustotal: Detection: 27%

Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49730 -> 45.15.156.127:48665
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49730 -> 45.15.156.127:48665
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 45.15.156.127:48665 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 45.15.156.127:48665 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.15.156.127:48665

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 45.15.156.127:48665

Source: Joe Sandbox View

IP Address: 45.15.156.127 45.15.156.127

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000036A4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000036A4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000036A4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003700000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000036A4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1887950311.0000000000EA9000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1888124901.0000000000F22000.00000020.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00E9E031	0_2_00E9E031
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00E91000	0_2_00E91000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_0175DCD4	0_2_0175DCD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_05E3BCE4	0_2_05E3BCE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_05E3E698	0_2_05E3E698
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_05E31629	0_2_05E31629
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_05E31638	0_2_05E31638
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_05E30144	0_2_05E30144

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: String function: 00E923A0 appears 33 times

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1889086283.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.Agent.446.6903.exe
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.Agent.446.6903.exe
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1887950311.0000000000EEA000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCadency.exe8 vs SecuriteInfo.com.Trojan.Agent.446.6903.exe
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1888221313.0000000000F64000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCadency.exe8 vs SecuriteInfo.com.Trojan.Agent.446.6903.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Static PE information: Section: .reloc IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/1@0/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Virustotal: Detection: 27%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32

Jump to behavior

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: 0_2_00E9F000 VirtualAlloc,LoadLibraryA,GetProcAddress,GetProcAddress,lstrlenW,CreateThread,Sleep,WaitForSingleObject,

0_2_00E9F000

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	Static PE information: section name: .xzyutr
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe	Static PE information: section name: .61g2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00EA1520 push eax; ret	0_2_00EA1540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00E9E764 push ecx; ret	0_2_00E9E777
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_07054530 push es; ret	0_2_070547A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_070547FE pushfd ; iretd	0_2_070547FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_070540F4 pushad ; ret	0_2_0705410D

Source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.raw.unpack, Egqpp0PKPHOlFlNdwj.cs	High entropy of concatenated method names: 'iWahvCn78', 'YqdgDAAES', 'Vi2d0tJRG', 'h7D91LL4y', 'S00NNYkxV', 'efeKkRfuw', 'eiIBWe6DK', 'tpP8STgbb', 'HFmURtgDU', 'Vi37uhDcy'
Source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.raw.unpack, WqRlSAmCMMEPWUm5Kg.cs	High entropy of concatenated method names: 'RV3EpiPs2', 'ha7CuiPJK', 'qiEwoierw', 'T4pkk5xr1', 'I7ruw25FQ', 'KJSjoTPGA', 'up0S1Len5', 'fKHDXKkRW', 'N26WZLh6F', 'jfaOtxD3o'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Memory allocated: 16F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Memory allocated: 3350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Memory allocated: 1990000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Window / User API: threadDelayed 2098			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Window / User API: threadDelayed 7379			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe TID: 7084

Thread sleep time: -25825441703193356s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1886719478.0000000001A3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "Vmcirb8bimipc
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1887600512.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1889176837.00000000014F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: 0_2_00E96594 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E96594

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: 0_2_00E9F000 VirtualAlloc,LoadLibraryA,GetProcAddress,GetProcAddress,lstrlenW,CreateThread,Sleep,WaitForSingleObject,

0_2_00E9F000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: 0_2_00E9F000 mov eax, dword ptr fs:[00000030h]

0_2_00E9F000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: 0_2_00E9944F GetProcessHeap,

0_2_00E9944F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00E925D3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E925D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00E96594 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E96594
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00E9217E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E9217E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Code function: 0_2_00E922DA SetUnhandledExceptionFilter,	0_2_00E922DA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: 0_2_00E923E5 cpuid

0_2_00E923E5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Code function: 0_2_00E92065 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E92065

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.f20000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1887950311.0000000000EA9000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1888124901.0000000000F22000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Agent.446.6903.exe PID: 6496, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLRkqP
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRkq
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRkqt
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLRkq
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq%appdata%`,kqdC:\Users\user\AppData\Roaming`,kqdC:\Users\user\AppData\Roaming\Binance
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLRkqt
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq&%localappdata%\Coinomi\Coinomi\walletsLRkq
Source: SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $kq5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Agent.446.6903.exe PID: 6496, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.ea9000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.f20000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Agent.446.6903.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1887950311.0000000000EA9000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1888124901.0000000000F22000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Agent.446.6903.exe PID: 6496, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Agent.446.6903.exe	27%	Virustotal		Browse
SecuriteInfo.com.Trojan.Agent.446.6903.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/	0%	Virustotal		Browse
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
45.15.156.127:48665	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
45.15.156.127:48665	14%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5ResponseD	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18	1%	Virustotal		Browse
http://tempuri.org/Entity/Id17	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse

Domains and IPs

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.15.156.127:48665	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003700000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	SecuriteInfo.com.Trojan.Agent.446.6903.exe, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1887950311.0000000000EA9000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1888124901.0000000000F22000.00000020.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.0000000004615000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000003.1820939594.00000000045FA000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1892043673.0000000004637000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000036A4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id11ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000036A4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id8Response	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17ResponseD	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	SecuriteInfo.com.Trojan.Agent.446.6903.exe, 00000000.00000002.1890169746.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.15.156.127	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1384466
Start date and time:	2024-02-01 02:51:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Agent.446.6903.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 76 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:52:11	API Interceptor	64x Sleep call for process: SecuriteInfo.com.Trojan.Agent.446.6903.exe modified

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

VirtualProtect, VirtualAlloc, LoadLibraryA, GetProcAddress, lstrlenW, CreateThread, Sleep, WaitForSingleObject, FreeConsole, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, WriteConsoleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, EncodePointer, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetFileType, GetStringTypeW, CompareStringW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, CreateFileW, CloseHandle, DecodePointer

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
45.15.156.127192.168.2.448665497302043234 02/01/24-02:52:04.219457	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	48665	49730	45.15.156.127	192.168.2.4
192.168.2.445.15.156.12749730486652043231 02/01/24-02:52:19.959258	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49730	48665	192.168.2.4	45.15.156.127
192.168.2.445.15.156.12749730486652046045 02/01/24-02:52:03.983916	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49730	48665	192.168.2.4	45.15.156.127
45.15.156.127192.168.2.448665497302046056 02/01/24-02:52:10.200070	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	48665	49730	45.15.156.127	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 1, 2024 02:52:02.937184095 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:03.172914982 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:03.173089027 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:03.292448997 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:03.527266026 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:03.569655895 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:03.983916044 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:04.219456911 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:04.272780895 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:09.963097095 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:10.200069904 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:10.200191021 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:10.200234890 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:10.200273037 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:10.200315952 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:10.200382948 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:10.200382948 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:10.241538048 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:10.686477900 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:10.921961069 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:10.968693018 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:11.203911066 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:11.257148981 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:11.335225105 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:11.569610119 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:11.581955910 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:11.817101002 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:11.866533041 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:14.026945114 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:14.261111021 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:14.262190104 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:14.268518925 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:14.503977060 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:14.529284000 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:14.766061068 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:14.819814920 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:14.858191013 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:15.093127012 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:15.147860050 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:15.304760933 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:15.540236950 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:15.585397959 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:15.769340992 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.003504992 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.004391909 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.054044962 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.130992889 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.365398884 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.365459919 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.365499020 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.365562916 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.366003036 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.366107941 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.406440973 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.406636953 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.599786997 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.599845886 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.599903107 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600027084 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.600105047 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600193024 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.600229025 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600264072 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600296021 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600337982 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.600501060 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600616932 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600650072 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600723028 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600755930 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.600833893 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.601028919 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.601108074 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.601145029 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.601176977 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.601207972 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.601237059 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.640897989 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.640980005 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.834445000 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.834481955 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.834512949 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.834569931 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.834645987 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.834743023 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.834778070 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.834810019 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.834965944 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835020065 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835184097 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835427999 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835462093 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835493088 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835536957 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835675955 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835783005 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835813999 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.835897923 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836138964 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.836199999 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836234093 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836280107 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:16.836291075 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836410046 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836441040 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836592913 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836623907 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.836656094 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837047100 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837080002 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837111950 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837142944 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837177992 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837208986 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837444067 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837477922 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837670088 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837743998 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.837817907 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.875543118 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:16.875627041 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.070904016 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.070965052 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071000099 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071033955 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071208954 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071244001 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071276903 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071388960 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.071518898 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.071543932 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071878910 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.071912050 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.072068930 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.072384119 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.072618008 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.072695971 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.072729111 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.072766066 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.072798014 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.073026896 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.073124886 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.305754900 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.305972099 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.306005955 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.306127071 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.306160927 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.306278944 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.306577921 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.306819916 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307001114 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307034969 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307148933 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307180882 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307214022 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307311058 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307379007 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307411909 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307622910 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307655096 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307686090 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307693958 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.307718039 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.307787895 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.307988882 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.308223963 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.308305979 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.308377028 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.308408976 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.308520079 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.308811903 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.308873892 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.541584015 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.541743994 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.541876078 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.541965961 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.541982889 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542026043 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542042971 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542426109 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542490959 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542673111 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542752028 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542768955 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542783976 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542886972 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.542995930 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.543011904 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.543315887 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.543488979 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.543504953 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.543668985 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.543692112 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544018030 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544034958 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544231892 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544248104 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544261932 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544307947 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.544394016 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.544450998 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544622898 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544713974 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544948101 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.544989109 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.545336962 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.545372963 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.545448065 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.545463085 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.545732021 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.545792103 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.545862913 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.546557903 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.546627998 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:17.778537989 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.778594017 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.778630018 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.778662920 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.778841972 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.778879881 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.778911114 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.779030085 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.779063940 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.779098988 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.779155970 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.779187918 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.779220104 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.780369043 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.780481100 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.780515909 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.780667067 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.780699968 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.780731916 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.780930996 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.781182051 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.781214952 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.781311989 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.781383991 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.781416893 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.781543970 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.781577110 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:17.783900976 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:18.018193960 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.018299103 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.018352985 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.018517017 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.019764900 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.029722929 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:18.264528036 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.269185066 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:18.503725052 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.504832029 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:18.739327908 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:18.747936010 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:18.982578993 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:19.000776052 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:19.235055923 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:19.235224962 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:19.241518021 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:19.477284908 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:19.487746000 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:19.723078012 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:19.723547935 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:19.958190918 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:19.959258080 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:20.196418047 CET	48665	49730	45.15.156.127	192.168.2.4
Feb 1, 2024 02:52:20.241739035 CET	49730	48665	192.168.2.4	45.15.156.127
Feb 1, 2024 02:52:20.307856083 CET	49730	48665	192.168.2.4	45.15.156.127

Target ID:	0
Start time:	02:51:56
Start date:	01/02/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Agent.446.6903.exe
Imagebase:	0xe90000
File size:	461'977 bytes
MD5 hash:	C8B5DCFBDBF417D517EDF952F366EF7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1887950311.0000000000EA9000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1888124901.0000000000F22000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1890169746.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1890169746.0000000003719000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:51:56
Start date:	01/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	16.9%
Signature Coverage:	6.2%
Total number of Nodes:	308
Total number of Limit Nodes:	13

Executed Functions

Function 00E9F000 Relevance: 21.2, APIs: 8, Strings: 3, Instructions: 1904
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00E9F369

Strings

, xrefs: 00E9FC78
C:\\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe, xrefs: 00EA024D
z, xrefs: 00EA025A

Memory Dump Source

Source File: 00000000.00000002.1887891991.0000000000E91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.1887865035.0000000000E90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887923708.0000000000EA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887950311.0000000000EA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887950311.0000000000EEA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888017349.0000000000EF5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888017349.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: $C:\\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe$z
API String ID: 4275171209-2249875393
Opcode ID: 79d1668fcbd47d92550e70a834c0b12b6ad7ce26379939201c74987faf515ed8
Instruction ID: cbe8863561f0aaf03f8533c65469c4679eda12501f7441e93fc9ddcb51750780
Opcode Fuzzy Hash: 79d1668fcbd47d92550e70a834c0b12b6ad7ce26379939201c74987faf515ed8
Instruction Fuzzy Hash: B4C26A77D11B1D4BE704CA7CCC853A8BAA2EBC9320F51E732D869EB7D4C73889458681

Uniqueness

Uniqueness Score: -1.00%

Function 05E3E698 Relevance: 8.3, Strings: 6, Instructions: 776
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjNp, xrefs: 05E3F126
(oq, xrefs: 05E3EBF0
0oNp, xrefs: 05E3EF85
(oq, xrefs: 05E3E728
(oq, xrefs: 05E3E776
DqNp, xrefs: 05E3EF91

Memory Dump Source

Source File: 00000000.00000002.1898999566.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$0oNp$DqNp$LjNp
API String ID: 0-2217272392
Opcode ID: ae556b751fab081bfbf44a2c32d33386d8cadc6f2472161d87eb85a60694f5ed
Instruction ID: a80bb5a49dc8c23fcd93b5321b41210133c394e33b90fe9c9e652fac4bcf1c41
Opcode Fuzzy Hash: ae556b751fab081bfbf44a2c32d33386d8cadc6f2472161d87eb85a60694f5ed
Instruction Fuzzy Hash: 30623B75A002189FDB14DF69C489AADBBF6FF88310F1580A9E846DB365DB35EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E3BCE4 Relevance: 3.4, Strings: 2, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	KFHX2S263Y.exe	Get hash	malicious	Stealc, Vidar	Browse	5.42.64.33
	SecuriteInfo.com.Win32.BotX-gen.27212.21808.exe	Get hash	malicious	Amadey	Browse	5.42.64.4
	EL76BXXsn2.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Xmrig, zgRAT	Browse	5.42.65.31
	file.exe	Get hash	malicious	Amadey, Fabookie, Glupteba, Stealc, Vidar	Browse	5.42.64.33
	Dolphin.exe	Get hash	malicious	RedLine	Browse	45.15.156.167
	file.exe	Get hash	malicious	Glupteba, GuLoader, Socks5Systemz, Stealc	Browse	5.42.64.33
	file.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Stealc, Vidar, Xmrig	Browse	45.15.156.201
	Investor.exe	Get hash	malicious	LummaC, Pure Miner, RedLine, Xmrig	Browse	45.15.156.43
	SecuriteInfo.com.Win32.PWSX-gen.23950.2214.exe	Get hash	malicious	Stealc, Vidar	Browse	5.42.64.33
	file.exe	Get hash	malicious	RedLine	Browse	45.15.156.201

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.060996774914389
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Agent.446.6903.exe
File size:	461'977 bytes
MD5:	c8b5dcfbdbf417d517edf952f366ef7f
SHA1:	be435b97e7f057d5d82bbed7a01fc857c4bdae75
SHA256:	d4e47ed98b4f06008fddd350f0516a0b2f1f8b1a1bdbb027328aa5b1b00b1893
SHA512:	4c3513e4bee0b6d2235878141da9a74b8a363ad49306b2f47a8e5e274ed63a83867eaf3577602c2fd054305ac3e4fb10df029dc3f7f148b0ab46cacbce8b5008
SSDEEP:	6144:PgHn0ajsNmRY44LKisu1z9rnlyFqYRGeIcIraNUlG7:P0n0afRnXA9LPYRGTaNKG7
TLSH:	02A49EBD74D3AC50E472CC779758F6783A3BBD21FD504A52E5396A2E0D302836FA4A12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...)...(...)...(...)...(...)...(...)...)...).l.(...).l.(...).l.(...)...)...).l.(...)Rich...).......................

Entrypoint:	0x401e07
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65BACEA4 [Wed Jan 31 22:50:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f427f7e2d298a968a6955e590f98f31e

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	04/10/2023 01:00:00 04/10/2024 00:59:59
Subject Chain	CN=Spotify AB, O=Spotify AB, L=Stockholm, C=SE, SERIALNUMBER=556703-7485, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=SE
Version:	3
Thumbprint MD5:	4D560750375195A86BA5F8F90C38104E
Thumbprint SHA-1:	AD50220499F12C553C03F7B4C172392DB8FC737B
Thumbprint SHA-256:	88AE80188017EFC3EB7550C57F8D18A0A76CD36BE1DE1EC47A5E85A0E5C2438A
Serial:	0FAB670A61BF4B7DAFD559356B5BCCFF

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x67000	0x43	.61g2
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17b7c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6e351	0x2948	.61g2
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x65000	0x1058	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x17060	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16fa0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.15.156.127	axfdj9gfw.exe	Get hash	malicious	RedLine	Browse
	last.exe	Get hash	malicious	RedLine, Xmrig	Browse
	edgag365.exe	Get hash	malicious	RedLine	Browse
	Shxdow.exe	Get hash	malicious	RedLine	Browse
	GLP3Q0PFY4.exe	Get hash	malicious	RedLine	Browse
	07CKY9gp1H.exe	Get hash	malicious	RedLine	Browse
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse
	2TWG5GKJcw.exe	Get hash	malicious	RedLine	Browse
	Fx7EIIKW9R.exe	Get hash	malicious	RedLine	Browse
	pooXYQy15z.exe	Get hash	malicious	RedLine	Browse

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdae3	0xdc00	af7c0227010b72a89ef9757ff8333d4f	False	0.5969637784090909	data	6.616748031599695	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xf000	0x16d1	0x1800	66910900a81ac799b74a242149cf928f	False	0.6705729166666666	data	5.834583863481259	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.xzyutr	0x11000	0x54b	0x600	900d3de3bf9cfa1ec0eaee1f6440afa9	False	0.7135416666666666	data	5.449253860816083	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x6222	0x6400	1d65cee4a8f013ce04933270fdbc306e	False	0.428203125	data	4.860739753245819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x4b570	0x4ac00	740d553c2a18e1f946de3f42844990c1	False	0.3778774299749164	data	4.983940276706137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x65000	0x1058	0x1200	87ac271cc8cdbb64979329ee4fef320c	False	0.7185329861111112	data	6.252663721569749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.61g2	0x67000	0xd000	0xc351	60bdcf21b6bcd3ab062b3246f5219394	False	0.752044959100818	data	5.959889322138283	IMAGE_SCN_MEM_READ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Agent.446.6903.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Windows Analysis Report
SecuriteInfo.com.Trojan.Agent.446.6903.exe

Function 00E9F000 Relevance: 21.2, APIs: 8, Strings: 3, Instructions: 1904
memoryCOMMON

Function 05E3E698 Relevance: 8.3, Strings: 6, Instructions: 776
COMMON

Function 05E3BCE4 Relevance: 3.4, Strings: 2, Instructions: 890
COMMON