Windows Analysis Report
PjNMCtS6PN.exe

Overview

General Information

Sample name: PjNMCtS6PN.exe
renamed because original name is a hash value
Original sample name: ab5cc3a661a3ccd83c44bf77517cd525.exe
Analysis ID: 1417259
MD5: ab5cc3a661a3ccd83c44bf77517cd525
SHA1: ec14a74050546603b3eaa8d554bb0abee62c883b
SHA256: 744ed761a0f877dcd3897d0b1bb05c3b3e29a27fc175760288d7f1dcc5d53e0d
Tags: exe
Infos:

Detection

Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Stealc
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found potential string decryption / allocating functions
One or more processes crash
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: PjNMCtS6PN.exe Avira: detected
Antivirus detection for URL or domain
Source: http://5.42.64.41/40d570f44e84a454.php URL Reputation: Label: malware
Found malware configuration
Source: 00000002.00000003.1308675273.00000000024B0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://5.42.64.41/40d570f44e84a454.php"}
Multi AV Scanner detection for submitted file
Source: PjNMCtS6PN.exe ReversingLabs: Detection: 86%
Machine Learning detection for sample
Source: PjNMCtS6PN.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetProcAddress
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: LoadLibraryA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: lstrcatA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: OpenEventA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CreateEventA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CloseHandle
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Sleep
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetUserDefaultLangID
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: VirtualAllocExNuma
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: VirtualFree
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetSystemInfo
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: VirtualAlloc
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: HeapAlloc
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetComputerNameA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: lstrcpyA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetProcessHeap
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetCurrentProcess
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: lstrlenA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ExitProcess
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetSystemTime
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SystemTimeToFileTime
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: advapi32.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: gdi32.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: user32.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: crypt32.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ntdll.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetUserNameA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CreateDCA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetDeviceCaps
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ReleaseDC
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CryptStringToBinaryA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sscanf
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: VMwareVMware
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: HAL9TH
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: JohnDoe
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: DISPLAY
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: default3
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetFileAttributesA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GlobalLock
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: HeapFree
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetFileSize
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GlobalSize
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: IsWow64Process
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Process32Next
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetLocalTime
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: FreeLibrary
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetTimeZoneInformation
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetSystemPowerStatus
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetVolumeInformationA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Process32First
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetLocaleInfoA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetModuleFileNameA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: DeleteFileA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: FindNextFileA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: LocalFree
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: FindClose
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: LocalAlloc
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetFileSizeEx
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ReadFile
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SetFilePointer
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: WriteFile
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CreateFileA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: FindFirstFileA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CopyFileA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: VirtualProtect
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetLastError
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: lstrcpynA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: MultiByteToWideChar
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GlobalFree
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: WideCharToMultiByte
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GlobalAlloc
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: OpenProcess
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: TerminateProcess
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetCurrentProcessId
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: gdiplus.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ole32.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: bcrypt.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: wininet.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: shlwapi.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: shell32.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: psapi.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: rstrtmgr.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SelectObject
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: BitBlt
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: DeleteObject
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CreateCompatibleDC
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdipGetImageEncoders
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdiplusStartup
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdiplusShutdown
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdipSaveImageToStream
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdipDisposeImage
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GdipFree
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetHGlobalFromStream
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CoUninitialize
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CoInitialize
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CoCreateInstance
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: BCryptDecrypt
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: BCryptSetProperty
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: BCryptDestroyKey
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetWindowRect
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetDesktopWindow
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetDC
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CloseWindow
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: wsprintfA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CharToOemW
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: wsprintfW
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RegQueryValueExA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RegEnumKeyExA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RegOpenKeyExA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RegCloseKey
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RegEnumValueA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CryptBinaryToStringA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CryptUnprotectData
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SHGetFolderPathA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ShellExecuteExA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: InternetOpenUrlA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: InternetConnectA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: InternetCloseHandle
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: InternetOpenA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: HttpSendRequestA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: HttpOpenRequestA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: InternetReadFile
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: InternetCrackUrlA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: StrCmpCA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: StrStrA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: StrCmpCW
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: PathMatchSpecA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: GetModuleFileNameExA
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RmStartSession
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RmRegisterResources
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RmGetList
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: RmEndSession
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_open
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_step
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_column_text
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_finalize
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_close
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_column_bytes
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3_column_blob
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: encrypted_key
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: browser:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: profile:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: login:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: password:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Opera
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: OperaGX
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Network
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: cookies
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: FALSE
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: autofill
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SELECT name, value FROM autofill
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: history
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: month:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Cookies
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Login Data
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: History
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: logins.json
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: formSubmitURL
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: usernameField
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: encryptedUsername
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: encryptedPassword
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: formhistory.sqlite
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: cookies.sqlite
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: places.sqlite
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: plugins
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Local Extension Settings
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: IndexedDB
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Opera Stable
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Opera GX Stable
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: CURRENT
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: chrome-extension_
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Local State
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: profiles.ini
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: chrome
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: opera
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: firefox
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: wallets
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ProductName
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: DisplayName
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ProcessorNameString
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: DisplayVersion
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Network Info:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: System Summary:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Installed Apps:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Current User:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Process List:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: system_info.txt
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: freebl3.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: mozglue.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: msvcp140.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: softokn3.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: vcruntime140.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: runas
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: files
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: F8806DD0C461824F*
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Telegram
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Password
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Pidgin
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: accounts.xml
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: config.vdf
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: 00000001
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: 00000002
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: 00000003
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: 00000004
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: token:
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Software\Valve\Steam
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: SteamPath
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: DialogConfig.vdf
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: libraryfolders.vdf
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: loginusers.vdf
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: sqlite3.dll
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: browsers
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: https
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: build
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: token
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: message
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00406C00 CryptStringToBinaryA,CryptStringToBinaryA, 2_2_00406C00
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00409520 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat, 2_2_00409520
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00996E67 CryptStringToBinaryA,CryptStringToBinaryA, 2_2_00996E67
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00999787 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat, 2_2_00999787

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Unpacked PE file: 2.2.PjNMCtS6PN.exe.400000.0.unpack
Uses 32bit PE files
Source: PjNMCtS6PN.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: Binary string: VC:\kucaxobihepo58\wuyemex\29\bajani\lev36-mu.pdb source: PjNMCtS6PN.exe
Source: Binary string: C:\kucaxobihepo58\wuyemex\29\bajani\lev36-mu.pdb source: PjNMCtS6PN.exe

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://5.42.64.41/40d570f44e84a454.php
Source: Amcache.hve.9.dr String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000002.00000002.1354959190.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.1354993858.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Detected potential crypto function
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_009A99D7 2_2_009A99D7
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: String function: 00404250 appears 343 times
One or more processes crash
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7404 -s 456
Sample file is different than original file name gathered from version info
Source: PjNMCtS6PN.exe, 00000002.00000000.1304036193.000000000084C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameLariauts@ vs PjNMCtS6PN.exe
Source: PjNMCtS6PN.exe Binary or memory string: OriginalFilenameLariauts@ vs PjNMCtS6PN.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Section loaded: sspicli.dll Jump to behavior
Uses 32bit PE files
Source: PjNMCtS6PN.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000002.00000002.1354959190.00000000008AD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.1354993858.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: PjNMCtS6PN.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@2/5@0/0
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_008B179B CreateToolhelp32Snapshot,Module32First, 2_2_008B179B
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7404
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\5e84f126-4b2a-4054-804a-2db055fa7a01 Jump to behavior
Source: PjNMCtS6PN.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PjNMCtS6PN.exe ReversingLabs: Detection: 86%
Source: unknown Process created: C:\Users\user\Desktop\PjNMCtS6PN.exe "C:\Users\user\Desktop\PjNMCtS6PN.exe"
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7404 -s 456
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: PjNMCtS6PN.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: VC:\kucaxobihepo58\wuyemex\29\bajani\lev36-mu.pdb source: PjNMCtS6PN.exe
Source: Binary string: C:\kucaxobihepo58\wuyemex\29\bajani\lev36-mu.pdb source: PjNMCtS6PN.exe

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Unpacked PE file: 2.2.PjNMCtS6PN.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Unpacked PE file: 2.2.PjNMCtS6PN.exe.400000.0.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00413500 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 2_2_00413500
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_008AD8A6 push eax; retf 2_2_008AD8C5
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_008B26DC pushad ; ret 2_2_008B26DE
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_008B2351 push 41415776h; iretd 2_2_008B242F
Source: PjNMCtS6PN.exe Static PE information: section name: .text entropy: 7.389942957714196
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00413500 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 2_2_00413500
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking locale)
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_004010F0 GetSystemInfo,ExitProcess, 2_2_004010F0
Source: Amcache.hve.9.dr Binary or memory string: VMware
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: PjNMCtS6PN.exe, 00000002.00000002.1355122445.0000000002645000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Amcache.hve.9.dr Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.9.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe API call chain: ExitProcess graph end node
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00413500 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 2_2_00413500
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_004133F0 mov eax, dword ptr fs:[00000030h] 2_2_004133F0
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_008B1078 push dword ptr fs:[00000030h] 2_2_008B1078
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_009A3657 mov eax, dword ptr fs:[00000030h] 2_2_009A3657
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00990D90 mov eax, dword ptr fs:[00000030h] 2_2_00990D90
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_0099092B mov eax, dword ptr fs:[00000030h] 2_2_0099092B
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00411AF0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA, 2_2_00411AF0
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_004116A0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess, 2_2_004116A0
Source: C:\Users\user\Desktop\PjNMCtS6PN.exe Code function: 2_2_00411AB0 GetProcessHeap,RtlAllocateHeap,GetUserNameA, 2_2_00411AB0
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.9.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Stealc
Source: Yara match File source: 2.3.PjNMCtS6PN.exe.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PjNMCtS6PN.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PjNMCtS6PN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.1354993858.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1308675273.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1354585430.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Stealc
Source: Yara match File source: 2.3.PjNMCtS6PN.exe.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PjNMCtS6PN.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PjNMCtS6PN.exe.990e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PjNMCtS6PN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.1354993858.0000000000990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1308675273.00000000024B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1354585430.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417259 Sample: PjNMCtS6PN.exe Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 11 Found malware configuration 2->11 13 Malicious sample detected (through community Yara rule) 2->13 15 Antivirus detection for URL or domain 2->15 17 6 other signatures 2->17 6 PjNMCtS6PN.exe 2->6         started        process3 signatures4 19 Detected unpacking (changes PE section rights) 6->19 21 Detected unpacking (overwrites its own PE header) 6->21 23 Found evasive API chain (may stop execution after checking locale) 6->23 9 WerFault.exe 22 16 6->9         started        process5
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://5.42.64.41/40d570f44e84a454.php true
  • URL Reputation: malware
 unknown