Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Analysis ID: 1427743
MD5: f4babeed860c7952cb00bae31c4bfa54
SHA1: c818efd3d709df2baa44767b1332bb2df045f7a8
SHA256: ef171f71804fe96bf375379c691e1f93b3fe38a3535b24f8f19d104e5eecf7aa
Tags: AgentTeslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection

barindex
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Avira: detected
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Virustotal: Detection: 35% Perma Link
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Joe Sandbox ML: detected
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 4x nop then jmp 078C3330h 0_2_078C37D3
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 50.87.219.149:587
Source: Joe Sandbox View IP Address: 50.87.219.149 50.87.219.149
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 50.87.219.149:587
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.alkuwaiti.com
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000001005000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261100936.0000000001039000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3265792695.0000000006789000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000001005000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261100936.0000000001039000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3265792695.0000000006789000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002D71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000001005000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261100936.0000000001039000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3265792695.0000000006789000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260615126.0000000001005000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261100936.0000000001039000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3265792695.0000000006789000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2066897818.0000000004E04000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260191325.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2066897818.0000000004E04000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260191325.0000000000402000.00000040.00000400.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002D71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002D71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261785904.0000000002D71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49708 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, oAKy.cs .Net Code: CHgRvKS

System Summary

barindex
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, Resources.cs Large array initialization: : array initializer size 630549
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_05771538 0_2_05771538
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07420040 0_2_07420040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07423F98 0_2_07423F98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07420EF0 0_2_07420EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07423C80 0_2_07423C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07423240 0_2_07423240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07426148 0_2_07426148
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07426158 0_2_07426158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07428177 0_2_07428177
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07428100 0_2_07428100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07420006 0_2_07420006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07423008 0_2_07423008
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_0742F010 0_2_0742F010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_0742F020 0_2_0742F020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_074280F0 0_2_074280F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07422FF8 0_2_07422FF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07423F89 0_2_07423F89
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07424E40 0_2_07424E40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07420EB9 0_2_07420EB9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07421DD9 0_2_07421DD9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07421DE0 0_2_07421DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07423C70 0_2_07423C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07422C89 0_2_07422C89
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07422C98 0_2_07422C98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_0742EBD0 0_2_0742EBD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_0742EBE8 0_2_0742EBE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_078C0C50 0_2_078C0C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_078C02A0 0_2_078C02A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_078C1148 0_2_078C1148
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_0139E6A9 3_2_0139E6A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_01394AA0 3_2_01394AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_01393E88 3_2_01393E88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_013941D0 3_2_013941D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069EA068 3_2_069EA068
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F5598 3_2_069F5598
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F65E8 3_2_069F65E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069FB230 3_2_069FB230
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F3048 3_2_069F3048
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069FC198 3_2_069FC198
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F7D78 3_2_069F7D78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F7698 3_2_069F7698
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069FE3B0 3_2_069FE3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F0040 3_2_069F0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F5CE5 3_2_069F5CE5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F0006 3_2_069F0006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069F0556 3_2_069F0556
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2066897818.0000000004AA6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2066897818.0000000004E04000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2071632145.000000000B5D0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2065404021.000000000112E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2066200681.00000000030C1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2070374607.0000000005C50000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000000.00000002.2066200681.00000000033E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260191325.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3260362205.0000000000BB8000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Binary or memory string: OriginalFilenamekugR.exe< vs SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, ekKu0.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, vKf1z6NvS.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, ZNAvlD7qmXc.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, U2doU2.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, BgffYko.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, HrTdA63.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, Vvp22TrBv9g.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, Vvp22TrBv9g.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, Vvp22TrBv9g.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, Vvp22TrBv9g.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, ObjHrafHCDPkxn9Q6W.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, ObjHrafHCDPkxn9Q6W.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, WnXetM0ArtAll2FBvV.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, WnXetM0ArtAll2FBvV.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, WnXetM0ArtAll2FBvV.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, WnXetM0ArtAll2FBvV.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, WnXetM0ArtAll2FBvV.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, WnXetM0ArtAll2FBvV.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.log Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Mutant created: \Sessions\1\BaseNamedObjects\vGcGFBmZoGZOceLrZDVsRB
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Virustotal: Detection: 35%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe:Zone.Identifier Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

barindex
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, Form1.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, WnXetM0ArtAll2FBvV.cs .Net Code: oYn81KEEoR System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, WnXetM0ArtAll2FBvV.cs .Net Code: oYn81KEEoR System.Reflection.Assembly.Load(byte[])
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_056D226C push ebx; ret 0_2_056D226D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_01393405 pushfd ; iretd 0_2_01393409
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_01393EF7 push ebp; ret 0_2_01393EF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_07420947 pushad ; retf 0_2_07420948
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_0742093D pushad ; retf 0_2_0742093E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 0_2_078C6B75 push FFFFFF8Bh; iretd 0_2_078C6B77
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_01390C3D push edi; ret 3_2_01390CC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_01390C95 push edi; retf 3_2_01390C3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Code function: 3_2_069EFCBC push es; retf 3_2_069EFCC8
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Static PE information: section name: .text entropy: 7.9719974623886785
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, W2oVZw8noIZNLftIfT.cs High entropy of concatenated method names: 'QkLBsbjHra', 'uCDB0Pkxn9', 'i0IB3PMWXZ', 's7qBaXQm3S', 'T8jBloPT0H', 'AW9Bg877m5', 'DZTt2it8lpvyWaVGYq', 'X9W0kXz5JWYCiCxc7x', 'pIZBBbsjYL', 'WGABrIBIq9'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, XCK07T4CvUPZ0LZ4VF.cs High entropy of concatenated method names: 'OlcR3NNpMn', 'Mu7Rab8voC', 'ToString', 'pA2RA5EfKQ', 'GT5RJsYJDr', 'VYWRxva6XA', 'lx0RFhDMnZ', 'XsIRIw2Tto', 'qGQRsXO3OA', 'zUsR0JocYU'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, pWUE6OJ8yOYNGaosMc.cs High entropy of concatenated method names: 'Dispose', 'NvyBe8vpp7', 'W0NVX5o26A', 'fN9NNYHfAI', 'E61B2OyUpp', 'KrJBzm2V3h', 'ProcessDialogKey', 'WWBVGV8exN', 'QU6VBy0aXr', 'WByVVlaaP5'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, FgKc7VNucluUqd2h2R.cs High entropy of concatenated method names: 'V4SRUh4kVF', 'JsuR2P5uVR', 'XHqSGJhNCB', 'SYrSBFKBij', 't8GRWFq37r', 'GkeRdYxFfn', 'tINR7oZ1hx', 'GGFRTdLWCX', 'YSAROTGN69', 'e8qRtp9YVf'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, WnXetM0ArtAll2FBvV.cs High entropy of concatenated method names: 'GLOrjUs5qy', 'dZ7rAtnrsY', 'uSXrJdNmwT', 'uWJrxZhs63', 'GtgrFTMAFH', 'b0lrIal51v', 'nLCrsVpwA2', 'TRtr0it6Rr', 'P9yrovfMNu', 'SCqr3MVidQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, ObjHrafHCDPkxn9Q6W.cs High entropy of concatenated method names: 'zsVJTdifkd', 'K2gJOAdnMc', 'uSrJt5dmgd', 'vCUJ4ex3ve', 'zNFJqbv3lo', 'PMVJNUBZ4O', 'O1QJbvQtPQ', 'qNqJU7sY5K', 'foGJeaX7rX', 'LVsJ2gL0VO'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, DmCcKFK0IPMWXZ97qX.cs High entropy of concatenated method names: 'al2xcBZ7MT', 'xoaxvUucVx', 'IoQxflrdhn', 'AgpxKlGV1W', 'mHMxlaG0BJ', 'sCuxgQjHqH', 'WadxRxdIga', 'm88xSB5NlU', 'Ao8x972V01', 'SrXxZQCVOy'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, Q0HcW9D877m5eI86a7.cs High entropy of concatenated method names: 'n9yIjFtbF4', 'iWTIJfrXuB', 'rHAIFyS4jK', 'AkKIsuABCr', 'oLjI0GduIk', 'seIFq89eLe', 'wXNFN8RFMX', 'hiQFbdbGpa', 'uj7FUCL17V', 'IwvFevvhXj'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, paaP5t23Wf5EZKU9I1.cs High entropy of concatenated method names: 'wob9BhJf1i', 'pJw9rFO3G3', 'HbK98laKRd', 'ujP9AXcy6E', 'CAJ9J2bKvk', 'qxV9FuSymu', 'eRi9IKJdrT', 'QhbSbn4y0M', 'vLrSUmOLqs', 'CQhSeykZUp'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, SqDhCdBVqkPc7mcoojn.cs High entropy of concatenated method names: 'S4vZP5rYfp', 'KliZhU151x', 'qCFZ16yeRl', 'wCkBN6RRbTy548C4HZf', 'kekOPURIjnk4AL3lYZO', 'GmCyYJRB7JptnivsnT6', 'KS27VdR7iTl4mxhD9gX', 'UNItjdRrjg2MXlyONrE'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, O3F0AYw1NXJKpFIM2X.cs High entropy of concatenated method names: 'NtxsPGo2nG', 'ioNshXluY0', 'HOrs1VDWih', 'uPusc7k6lv', 'rQ1s52q8dR', 'PfLsvh9yDL', 'RwWsukrRTd', 'QKisfNsOQD', 'zB2sKSgo92', 'pvNsYslBjN'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, YcY1VjVQsRwIGoEksb.cs High entropy of concatenated method names: 'aj41NE1Uv', 'XNncHpQkc', 'eGTvvMIHZ', 'a90ujNB2O', 'tsdKqnSI8', 'JRcYVJkPP', 'L4KStwn6wglDAD01JG', 'JXjkWB5wDn4bQPBmdy', 'TeQSHTDA6', 'J77ZjevBX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, aNIa7szEoxQuTqJ4CQ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'I0k96i8lc8', 'OZV9lQA20G', 'JoV9gjufDV', 'L6J9ROy66e', 'eUf9SwMd1J', 'YPW99dIgur', 'fox9ZylwBh'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, O3x211BGWSnFU7J8LK4.cs High entropy of concatenated method names: 'WKY9P8vO37', 'hjR9hJuU2i', 'Ayl91FNJTK', 'Rlm9c934lt', 'dLV95tIg4a', 'qvS9vuCivf', 'ER99uHph47', 'Bof9fvo0BW', 'GRA9Kc6oHA', 'gAQ9YjQPZF'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, Im3SNUYA4OoAs48joP.cs High entropy of concatenated method names: 'MGdF5BkT0b', 'fQxFuFuJ5C', 'dJTxn2fHdV', 'lD7xQHLDkv', 'dBdxk4AFrG', 'PqgxC32WAH', 'hxmxp0cUM3', 'rvoxmyHSi2', 'TAZxwCKAv5', 'gVhxLQn1GY'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, bV8exNe7U6y0aXrbBy.cs High entropy of concatenated method names: 'm7ASDQH0pw', 'o6HSXBgBK1', 'k4kSnJU4DN', 'fOsSQhx5Ob', 'xeOSToXobr', 'jOSSkZfUVI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, fxVcsY7ME09f7oRmwm.cs High entropy of concatenated method names: 'Wxp6fQ0mPT', 'uoc6KwsXTy', 'Fy26D5V4Z4', 'pcj6XO2ZAQ', 'mlq6QQM1AI', 'LvP6kMWtFT', 'MPI6p8NxjY', 'ItA6mGtmNF', 'CV46L7Zxoq', 'may6WSQ0OZ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, LEBdxRTMrnSpatktya.cs High entropy of concatenated method names: 'dPjlLHl2tc', 'v6oldqAcd7', 'qrulTdRZZp', 'oPKlODne83', 'q4ilXOhCx4', 'X8ilnAm2id', 'ub4lQH9dkc', 'FnGlkQYrUW', 'F1MlC5RW1n', 'Vnslp1ahfU'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, o1OyUpUpCrJm2V3hUW.cs High entropy of concatenated method names: 'CZDSAo8vEb', 'yVaSJhIpX4', 'NbqSxEnSoi', 'qGGSFmwqS4', 'rtlSIwRkyL', 'hAHSsLgY7f', 'WL7S040oIt', 'RY3SoMECZR', 'ie3S3oNTbk', 'HTPSamPsiY'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, T2S5hSBrc8XPGFgEnTS.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'wIMZTAYXRG', 'S6YZOxM0vT', 'RAbZt4T0ag', 'sV9Z4IwrT5', 'WNkZqbImeN', 'WdQZN7id9k', 'erbZbwHNQU'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4d2a400.4.raw.unpack, fYfX8Xp3pcvd29DGCX.cs High entropy of concatenated method names: 'MFYsALOKMv', 'ypisxXb8sH', 'LcrsIcn8XH', 'bwjI2Vf5No', 'k12IzN1e9h', 'h3csGUtdRm', 'ii7sBQIU7C', 'jvWsVS65Xp', 'aaksrv57eN', 'ehis8LY5Jx'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, W2oVZw8noIZNLftIfT.cs High entropy of concatenated method names: 'QkLBsbjHra', 'uCDB0Pkxn9', 'i0IB3PMWXZ', 's7qBaXQm3S', 'T8jBloPT0H', 'AW9Bg877m5', 'DZTt2it8lpvyWaVGYq', 'X9W0kXz5JWYCiCxc7x', 'pIZBBbsjYL', 'WGABrIBIq9'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, XCK07T4CvUPZ0LZ4VF.cs High entropy of concatenated method names: 'OlcR3NNpMn', 'Mu7Rab8voC', 'ToString', 'pA2RA5EfKQ', 'GT5RJsYJDr', 'VYWRxva6XA', 'lx0RFhDMnZ', 'XsIRIw2Tto', 'qGQRsXO3OA', 'zUsR0JocYU'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, pWUE6OJ8yOYNGaosMc.cs High entropy of concatenated method names: 'Dispose', 'NvyBe8vpp7', 'W0NVX5o26A', 'fN9NNYHfAI', 'E61B2OyUpp', 'KrJBzm2V3h', 'ProcessDialogKey', 'WWBVGV8exN', 'QU6VBy0aXr', 'WByVVlaaP5'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, FgKc7VNucluUqd2h2R.cs High entropy of concatenated method names: 'V4SRUh4kVF', 'JsuR2P5uVR', 'XHqSGJhNCB', 'SYrSBFKBij', 't8GRWFq37r', 'GkeRdYxFfn', 'tINR7oZ1hx', 'GGFRTdLWCX', 'YSAROTGN69', 'e8qRtp9YVf'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, WnXetM0ArtAll2FBvV.cs High entropy of concatenated method names: 'GLOrjUs5qy', 'dZ7rAtnrsY', 'uSXrJdNmwT', 'uWJrxZhs63', 'GtgrFTMAFH', 'b0lrIal51v', 'nLCrsVpwA2', 'TRtr0it6Rr', 'P9yrovfMNu', 'SCqr3MVidQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, ObjHrafHCDPkxn9Q6W.cs High entropy of concatenated method names: 'zsVJTdifkd', 'K2gJOAdnMc', 'uSrJt5dmgd', 'vCUJ4ex3ve', 'zNFJqbv3lo', 'PMVJNUBZ4O', 'O1QJbvQtPQ', 'qNqJU7sY5K', 'foGJeaX7rX', 'LVsJ2gL0VO'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, DmCcKFK0IPMWXZ97qX.cs High entropy of concatenated method names: 'al2xcBZ7MT', 'xoaxvUucVx', 'IoQxflrdhn', 'AgpxKlGV1W', 'mHMxlaG0BJ', 'sCuxgQjHqH', 'WadxRxdIga', 'm88xSB5NlU', 'Ao8x972V01', 'SrXxZQCVOy'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, Q0HcW9D877m5eI86a7.cs High entropy of concatenated method names: 'n9yIjFtbF4', 'iWTIJfrXuB', 'rHAIFyS4jK', 'AkKIsuABCr', 'oLjI0GduIk', 'seIFq89eLe', 'wXNFN8RFMX', 'hiQFbdbGpa', 'uj7FUCL17V', 'IwvFevvhXj'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, paaP5t23Wf5EZKU9I1.cs High entropy of concatenated method names: 'wob9BhJf1i', 'pJw9rFO3G3', 'HbK98laKRd', 'ujP9AXcy6E', 'CAJ9J2bKvk', 'qxV9FuSymu', 'eRi9IKJdrT', 'QhbSbn4y0M', 'vLrSUmOLqs', 'CQhSeykZUp'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, SqDhCdBVqkPc7mcoojn.cs High entropy of concatenated method names: 'S4vZP5rYfp', 'KliZhU151x', 'qCFZ16yeRl', 'wCkBN6RRbTy548C4HZf', 'kekOPURIjnk4AL3lYZO', 'GmCyYJRB7JptnivsnT6', 'KS27VdR7iTl4mxhD9gX', 'UNItjdRrjg2MXlyONrE'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, O3F0AYw1NXJKpFIM2X.cs High entropy of concatenated method names: 'NtxsPGo2nG', 'ioNshXluY0', 'HOrs1VDWih', 'uPusc7k6lv', 'rQ1s52q8dR', 'PfLsvh9yDL', 'RwWsukrRTd', 'QKisfNsOQD', 'zB2sKSgo92', 'pvNsYslBjN'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, YcY1VjVQsRwIGoEksb.cs High entropy of concatenated method names: 'aj41NE1Uv', 'XNncHpQkc', 'eGTvvMIHZ', 'a90ujNB2O', 'tsdKqnSI8', 'JRcYVJkPP', 'L4KStwn6wglDAD01JG', 'JXjkWB5wDn4bQPBmdy', 'TeQSHTDA6', 'J77ZjevBX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, aNIa7szEoxQuTqJ4CQ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'I0k96i8lc8', 'OZV9lQA20G', 'JoV9gjufDV', 'L6J9ROy66e', 'eUf9SwMd1J', 'YPW99dIgur', 'fox9ZylwBh'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, O3x211BGWSnFU7J8LK4.cs High entropy of concatenated method names: 'WKY9P8vO37', 'hjR9hJuU2i', 'Ayl91FNJTK', 'Rlm9c934lt', 'dLV95tIg4a', 'qvS9vuCivf', 'ER99uHph47', 'Bof9fvo0BW', 'GRA9Kc6oHA', 'gAQ9YjQPZF'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, Im3SNUYA4OoAs48joP.cs High entropy of concatenated method names: 'MGdF5BkT0b', 'fQxFuFuJ5C', 'dJTxn2fHdV', 'lD7xQHLDkv', 'dBdxk4AFrG', 'PqgxC32WAH', 'hxmxp0cUM3', 'rvoxmyHSi2', 'TAZxwCKAv5', 'gVhxLQn1GY'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, bV8exNe7U6y0aXrbBy.cs High entropy of concatenated method names: 'm7ASDQH0pw', 'o6HSXBgBK1', 'k4kSnJU4DN', 'fOsSQhx5Ob', 'xeOSToXobr', 'jOSSkZfUVI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, fxVcsY7ME09f7oRmwm.cs High entropy of concatenated method names: 'Wxp6fQ0mPT', 'uoc6KwsXTy', 'Fy26D5V4Z4', 'pcj6XO2ZAQ', 'mlq6QQM1AI', 'LvP6kMWtFT', 'MPI6p8NxjY', 'ItA6mGtmNF', 'CV46L7Zxoq', 'may6WSQ0OZ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, LEBdxRTMrnSpatktya.cs High entropy of concatenated method names: 'dPjlLHl2tc', 'v6oldqAcd7', 'qrulTdRZZp', 'oPKlODne83', 'q4ilXOhCx4', 'X8ilnAm2id', 'ub4lQH9dkc', 'FnGlkQYrUW', 'F1MlC5RW1n', 'Vnslp1ahfU'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, o1OyUpUpCrJm2V3hUW.cs High entropy of concatenated method names: 'CZDSAo8vEb', 'yVaSJhIpX4', 'NbqSxEnSoi', 'qGGSFmwqS4', 'rtlSIwRkyL', 'hAHSsLgY7f', 'WL7S040oIt', 'RY3SoMECZR', 'ie3S3oNTbk', 'HTPSamPsiY'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, T2S5hSBrc8XPGFgEnTS.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'wIMZTAYXRG', 'S6YZOxM0vT', 'RAbZt4T0ag', 'sV9Z4IwrT5', 'WNkZqbImeN', 'WdQZN7id9k', 'erbZbwHNQU'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.b5d0000.9.raw.unpack, fYfX8Xp3pcvd29DGCX.cs High entropy of concatenated method names: 'MFYsALOKMv', 'ypisxXb8sH', 'LcrsIcn8XH', 'bwjI2Vf5No', 'k12IzN1e9h', 'h3csGUtdRm', 'ii7sBQIU7C', 'jvWsVS65Xp', 'aaksrv57eN', 'ehis8LY5Jx'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 1350000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 30C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 2EF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 9040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 7570000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: A040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: B040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: B650000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: C650000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: D650000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 1390000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 2D70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: 13B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Window / User API: threadDelayed 3705 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Window / User API: threadDelayed 1565 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 7164 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 6340 Thread sleep count: 3705 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 6340 Thread sleep count: 1565 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -99000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98866s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98313s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98188s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -98063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97938s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97813s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -97129s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe TID: 1976 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99766 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99656 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99547 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99437 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99328 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99219 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99109 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 99000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98866 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98750 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98640 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98531 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98422 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98313 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98188 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 98063 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97938 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97813 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97703 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97594 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97469 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97359 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97250 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 97129 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe, 00000003.00000002.3261100936.0000000001039000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3261785904.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3261785904.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3261785904.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3260191325.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2066897818.0000000004E04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe PID: 2136, type: MEMORYSTR
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3261785904.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3260191325.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2066897818.0000000004E04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe PID: 2136, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e3f058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe.4e04638.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3261785904.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3261785904.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3261785904.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3260191325.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2066897818.0000000004E04000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe PID: 2136, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs