Source: dzn.ddns.net |
Avira URL Cloud: Label: malware |
Source: bUrP.exe |
Malware Configuration Extractor: Xworm {"C2 url": ["dzn.ddns.net"], "Port": "5552", "Aes key": "<123456789>", "Install file": "USB.exe", "Version": "XWorm V3.1"} |
Source: bUrP.exe |
ReversingLabs: Detection: 76% |
Source: bUrP.exe |
String decryptor: dzn.ddns.net |
Source: bUrP.exe |
String decryptor: 5552 |
Source: bUrP.exe |
String decryptor: <123456789> |
Source: bUrP.exe |
String decryptor: <Xwormmm> |
Source: bUrP.exe |
String decryptor: USB.exe |
Source: bUrP.exe |
Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE |
Source: bUrP.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: Malware configuration extractor |
URLs: dzn.ddns.net |
Source: unknown |
DNS query: name: dzn.ddns.net |
Source: global traffic |
TCP traffic: 192.168.2.4:49729 -> 191.233.27.50:5552 |
Source: Joe Sandbox View |
ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
DNS traffic detected: queries for: dzn.ddns.net |
Source: bUrP.exe, type: SAMPLE |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: bUrP.exe, 00000000.00000000.1618157418.000000000058A000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenameXClient.exe4 vs bUrP.exe |
Source: bUrP.exe |
Binary or memory string: OriginalFilenameXClient.exe4 vs bUrP.exe |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: bUrP.exe |
Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE |
Source: bUrP.exe, type: SAMPLE |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: bUrP.exe, Helper.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: bUrP.exe, Helper.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: bUrP.exe, AlgorithmAES.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: classification engine |
Classification label: mal100.troj.evad.winEXE@1/0@4/1 |
Source: C:\Users\user\Desktop\bUrP.exe |
Mutant created: \Sessions\1\BaseNamedObjects\JD7Bbn5DlVw5Yl4J |
Source: C:\Users\user\Desktop\bUrP.exe |
Mutant created: NULL |
Source: bUrP.exe |
Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: bUrP.exe |
Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80% |
Source: C:\Users\user\Desktop\bUrP.exe |
Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: bUrP.exe |
ReversingLabs: Detection: 76% |
Source: bUrP.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR |
Source: bUrP.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: bUrP.exe, Messages.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true) |
Source: bUrP.exe, Messages.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true) |
Source: bUrP.exe, Messages.cs |
.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true) |
Source: bUrP.exe, Messages.cs |
.Net Code: Plugin System.AppDomain.Load(byte[]) |
Source: bUrP.exe, Messages.cs |
.Net Code: Memory System.AppDomain.Load(byte[]) |
Source: bUrP.exe, Messages.cs |
.Net Code: Memory |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Memory allocated: CB0000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Memory allocated: 1A8E0000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Window / User API: threadDelayed 9727 |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe TID: 7640 |
Thread sleep count: 234 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe TID: 7640 |
Thread sleep time: -234000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe TID: 7640 |
Thread sleep count: 9727 > 30 |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe TID: 7640 |
Thread sleep time: -9727000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
File Volume queried: C:\ FullSizeInformation |
Jump to behavior |
Source: bUrP.exe, 00000000.00000002.4066689460.0000000000B16000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz |
Source: C:\Users\user\Desktop\bUrP.exe |
Process token adjusted: Debug |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Memory allocated: page read and write | page guard |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Queries volume information: C:\Users\user\Desktop\bUrP.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\bUrP.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Jump to behavior |
Source: Yara match |
File source: bUrP.exe, type: SAMPLE |
Source: Yara match |
File source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: bUrP.exe PID: 7576, type: MEMORYSTR |
Source: Yara match |
File source: bUrP.exe, type: SAMPLE |
Source: Yara match |
File source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: bUrP.exe PID: 7576, type: MEMORYSTR |