Windows Analysis Report
gZIZ5eyCtS.exe

Overview

General Information

Sample name: gZIZ5eyCtS.exe
renamed because original name is a hash value
Original sample name: 82437d591c16fcea83cd315465f5a67babb899186a4f8d464a7609ef8ae88468.exe
Analysis ID: 1422377
MD5: 9b7a1803cad3e79cb6449558d5ce938f
SHA1: 736f009ef8e35886fe5b0445e41dd4e6446352a7
SHA256: 82437d591c16fcea83cd315465f5a67babb899186a4f8d464a7609ef8ae88468
Tags: exe
Infos:

Detection

Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected Snake Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Found malware configuration
Source: 00000002.00000002.4559102503.00000000029A1000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "contabilidad@daipro.com.mx", "Password": "DAIpro123**", "Host": "mail.daipro.com.mx", "Port": "587"}
Multi AV Scanner detection for submitted file
Source: gZIZ5eyCtS.exe ReversingLabs: Detection: 63%
Machine Learning detection for sample
Source: gZIZ5eyCtS.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: gZIZ5eyCtS.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49711 version: TLS 1.0
Source: gZIZ5eyCtS.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: gZIZ5eyCtS.exe, 00000000.00000002.2097776825.0000000005A40000.00000004.08000000.00040000.00000000.sdmp, gZIZ5eyCtS.exe, 00000000.00000002.2097295389.0000000003571000.00000004.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 00CEECFDh 2_2_00CEEB10
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 00CEF687h 2_2_00CEEB10
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 00CEFDF9h 2_2_00CEFB39
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 2_2_00CEDED8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06696FA9h 2_2_06696D00
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06697D45h 2_2_06697A08
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06695119h 2_2_06694E70
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 066959C9h 2_2_06695720
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06696279h 2_2_06695FD0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 2_2_066927AA
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 2_2_066927B8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 066966FAh 2_2_06696450
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06690741h 2_2_06690498
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06697859h 2_2_066975B0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06694841h 2_2_06694598
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06694CC1h 2_2_06694A18
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06695571h 2_2_066952C8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 2_2_06692ACE
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06695E21h 2_2_06695B78
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 066902E9h 2_2_06690040
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06690B99h 2_2_066908F0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06696B51h 2_2_066968A8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 4x nop then jmp 06697401h 2_2_06697158

Networking
barindex
Uses dynamic DNS services
Source: unknown DNS query: name: aborters.duckdns.org
Yara detected Generic Downloader
Source: Yara match File source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49726 -> 51.38.247.67:8081
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 193.122.6.168 193.122.6.168
Source: Joe Sandbox View IP Address: 51.38.247.67 51.38.247.67
Source: Joe Sandbox View IP Address: 51.38.247.67 51.38.247.67
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: checkip.dyndns.org
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49711 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: checkip.dyndns.org
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081/_send_.php?TS
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081t-
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081/_send_.php?TS
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081t-
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B5B000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.00000000029A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B5B000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002A7B000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: gZIZ5eyCtS.exe String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.00000000029A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081/_send_.php?TS
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081t-
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B5B000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231
Source: gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B5B000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002AF6000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002B1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231$
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.gZIZ5eyCtS.exe.46115d0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.45c35a0.4.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.59b0000.6.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46115d0.3.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.59b0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.45c35a0.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.3583bfc.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.gZIZ5eyCtS.exe.35813d4.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000000.00000002.2097654328.00000000059B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 764, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 764, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 0_2_0175AC18 0_2_0175AC18
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEC1F0 2_2_00CEC1F0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CE6168 2_2_00CE6168
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEB388 2_2_00CEB388
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEC4D0 2_2_00CEC4D0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CE6790 2_2_00CE6790
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEC7B1 2_2_00CEC7B1
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CE98B8 2_2_00CE98B8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CECA91 2_2_00CECA91
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEEB10 2_2_00CEEB10
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEFB39 2_2_00CEFB39
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CE4B31 2_2_00CE4B31
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEBC32 2_2_00CEBC32
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEBF10 2_2_00CEBF10
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CE35C8 2_2_00CE35C8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEB552 2_2_00CEB552
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEDEC7 2_2_00CEDEC7
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_00CEDED8 2_2_00CEDED8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06699E58 2_2_06699E58
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06697F58 2_2_06697F58
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669B788 2_2_0669B788
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669C428 2_2_0669C428
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669A4A0 2_2_0669A4A0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06690D48 2_2_06690D48
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06696D00 2_2_06696D00
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669BDD8 2_2_0669BDD8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669CA70 2_2_0669CA70
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06697A08 2_2_06697A08
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669AAE8 2_2_0669AAE8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06699808 2_2_06699808
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669B138 2_2_0669B138
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06694E62 2_2_06694E62
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06694E70 2_2_06694E70
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06699E48 2_2_06699E48
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06695720 2_2_06695720
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06695710 2_2_06695710
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066997F8 2_2_066997F8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06695FC0 2_2_06695FC0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06695FD0 2_2_06695FD0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066927AA 2_2_066927AA
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066927B8 2_2_066927B8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669B780 2_2_0669B780
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06696440 2_2_06696440
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06696450 2_2_06696450
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669C418 2_2_0669C418
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06696CF0 2_2_06696CF0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06691CB0 2_2_06691CB0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06690488 2_2_06690488
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669A48F 2_2_0669A48F
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06690498 2_2_06690498
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06690D39 2_2_06690D39
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669BDC8 2_2_0669BDC8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066975A2 2_2_066975A2
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066975B0 2_2_066975B0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669458A 2_2_0669458A
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06694598 2_2_06694598
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669CA60 2_2_0669CA60
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06694A08 2_2_06694A08
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06694A18 2_2_06694A18
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066952C8 2_2_066952C8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669AAD8 2_2_0669AAD8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066952B8 2_2_066952B8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06695B68 2_2_06695B68
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06695B78 2_2_06695B78
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06692B30 2_2_06692B30
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06691BD0 2_2_06691BD0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06690040 2_2_06690040
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06693830 2_2_06693830
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06690006 2_2_06690006
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066908E1 2_2_066908E1
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066908F0 2_2_066908F0
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066968A8 2_2_066968A8
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06696897 2_2_06696897
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06697149 2_2_06697149
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_06697158 2_2_06697158
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_0669B128 2_2_0669B128
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Code function: 2_2_066979F8 2_2_066979F8
Sample file is different than original file name gathered from version info
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097410768.0000000004571000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameExample.dll0 vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097654328.00000000059B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameExample.dll0 vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000000.00000002.2095227268.00000000017AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097776825.0000000005A40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000000.00000000.2090963309.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameFlows.exe( vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097295389.0000000003571000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000000.00000002.2097295389.0000000003571000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000002.00000002.4558027995.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe, 00000002.00000002.4557870685.0000000000422000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs gZIZ5eyCtS.exe
Source: gZIZ5eyCtS.exe Binary or memory string: OriginalFilenameFlows.exe( vs gZIZ5eyCtS.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Section loaded: dpapi.dll Jump to behavior
Uses 32bit PE files
Source: gZIZ5eyCtS.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.gZIZ5eyCtS.exe.46115d0.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.gZIZ5eyCtS.exe.45c35a0.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.gZIZ5eyCtS.exe.59b0000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.gZIZ5eyCtS.exe.46115d0.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.gZIZ5eyCtS.exe.59b0000.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.gZIZ5eyCtS.exe.45c35a0.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.gZIZ5eyCtS.exe.3583bfc.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.gZIZ5eyCtS.exe.35813d4.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000000.00000002.2097654328.00000000059B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 764, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: gZIZ5eyCtS.exe PID: 764, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.gZIZ5eyCtS.exe.45c35a0.4.raw.unpack, DarkListView.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, COVIDPickers.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, COVIDPickers.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, COVIDPickers.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, COVIDPickers.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.46115d0.3.raw.unpack, DarkListView.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.59b0000.6.raw.unpack, DarkListView.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.gZIZ5eyCtS.exe.45c35a0.4.raw.unpack, DarkComboBox.cs Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.gZIZ5eyCtS.exe.46115d0.3.raw.unpack, DarkComboBox.cs Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.gZIZ5eyCtS.exe.59b0000.6.raw.unpack, DarkComboBox.cs Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@5/3
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gZIZ5eyCtS.exe.log Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Mutant created: NULL
Source: gZIZ5eyCtS.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gZIZ5eyCtS.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: gZIZ5eyCtS.exe, 00000002.00000002.4560338604.0000000003A2C000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002BEA000.00000004.00000800.00020000.00000000.sdmp, gZIZ5eyCtS.exe, 00000002.00000002.4559102503.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: gZIZ5eyCtS.exe ReversingLabs: Detection: 63%
Source: unknown Process created: C:\Users\user\Desktop\gZIZ5eyCtS.exe "C:\Users\user\Desktop\gZIZ5eyCtS.exe"
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process created: C:\Users\user\Desktop\gZIZ5eyCtS.exe "C:\Users\user\Desktop\gZIZ5eyCtS.exe"
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process created: C:\Users\user\Desktop\gZIZ5eyCtS.exe "C:\Users\user\Desktop\gZIZ5eyCtS.exe" Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: gZIZ5eyCtS.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: gZIZ5eyCtS.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: gZIZ5eyCtS.exe, 00000000.00000002.2097776825.0000000005A40000.00000004.08000000.00040000.00000000.sdmp, gZIZ5eyCtS.exe, 00000000.00000002.2097295389.0000000003571000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: gZIZ5eyCtS.exe, --.cs .Net Code: Shlyber System.AppDomain.Load(byte[])
Binary contains a suspicious time stamp
Source: gZIZ5eyCtS.exe Static PE information: 0xC9B7AA41 [Mon Mar 29 15:24:49 2077 UTC]
Source: gZIZ5eyCtS.exe Static PE information: section name: .text entropy: 7.194237788024208
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory allocated: 1710000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory allocated: 3570000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory allocated: 19A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory allocated: CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory allocated: 29A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory allocated: 49A0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599672 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599452 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599114 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598984 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598875 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598765 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598656 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598546 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598436 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598328 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598218 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598109 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598000 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597890 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597781 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597671 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597562 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597453 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597343 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597234 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597124 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597010 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596890 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596343 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596015 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595797 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595687 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595578 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595468 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595359 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595250 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595140 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595031 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594921 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594812 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594593 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Window / User API: threadDelayed 1169 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Window / User API: threadDelayed 8681 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 6716 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep count: 34 > 30 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -31359464925306218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 6452 Thread sleep count: 1169 > 30 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 6452 Thread sleep count: 8681 > 30 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599452s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -599114s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598546s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598436s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -598000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597671s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597124s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -597010s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -596015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -595031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -594921s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -594812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -594703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe TID: 5892 Thread sleep time: -594593s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599672 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599452 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 599114 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598984 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598875 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598765 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598656 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598546 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598436 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598328 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598218 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598109 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 598000 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597890 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597781 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597671 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597562 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597453 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597343 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597234 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597124 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 597010 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596890 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596343 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596234 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 596015 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595906 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595797 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595687 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595578 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595468 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595359 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595250 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595140 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 595031 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594921 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594812 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Thread delayed: delay time: 594593 Jump to behavior
Source: gZIZ5eyCtS.exe, 00000002.00000002.4558575688.0000000000F11000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 0.2.gZIZ5eyCtS.exe.3583bfc.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.gZIZ5eyCtS.exe.3583bfc.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.gZIZ5eyCtS.exe.3583bfc.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Memory written: C:\Users\user\Desktop\gZIZ5eyCtS.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Process created: C:\Users\user\Desktop\gZIZ5eyCtS.exe "C:\Users\user\Desktop\gZIZ5eyCtS.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Users\user\Desktop\gZIZ5eyCtS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Users\user\Desktop\gZIZ5eyCtS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4559102503.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gZIZ5eyCtS.exe PID: 764, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\gZIZ5eyCtS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gZIZ5eyCtS.exe PID: 764, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.gZIZ5eyCtS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46c3c60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gZIZ5eyCtS.exe.46a3a30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4559102503.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4557870685.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2097410768.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4559102503.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: gZIZ5eyCtS.exe PID: 2580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gZIZ5eyCtS.exe PID: 764, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1422377 Sample: gZIZ5eyCtS.exe Startdate: 08/04/2024 Architecture: WINDOWS Score: 100 14 aborters.duckdns.org 2->14 16 checkip.dyndns.org 2->16 18 4 other IPs or domains 2->18 26 Found malware configuration 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 34 8 other signatures 2->34 7 gZIZ5eyCtS.exe 3 2->7         started        signatures3 32 Uses dynamic DNS services 14->32 process4 signatures5 36 Injects a PE file into a foreign processes 7->36 10 gZIZ5eyCtS.exe 15 2 7->10         started        process6 dnsIp7 20 aborters.duckdns.org 51.38.247.67, 8081 OVHFR France 10->20 22 checkip.dyndns.com 193.122.6.168, 49710, 49713, 49715 ORACLE-BMC-31898US United States 10->22 24 reallyfreegeoip.org 172.67.177.134, 443, 49711, 49712 CLOUDFLARENETUS United States 10->24 38 Tries to steal Mail credentials (via file / registry access) 10->38 40 Tries to harvest and steal browser information (history, passwords, etc) 10->40 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
193.122.6.168
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
51.38.247.67
 varders.kozow.com France
16276 OVHFR true
172.67.177.134
 reallyfreegeoip.org United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 172.67.177.134 true
varders.kozow.com 51.38.247.67 true
checkip.dyndns.com 193.122.6.168 true
aborters.duckdns.org 51.38.247.67 true
anotherarmy.dns.army unknown unknown
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
  • URL Reputation: safe
 unknown
https://reallyfreegeoip.org/xml/102.129.152.231 false
  • Avira URL Cloud: safe
 unknown