Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Analysis ID:	1430188
MD5:	a4799079bc84bb2dd9a75c7121a0100e
SHA1:	c84b87b3af74643cd6b46e701090472ea105994c
SHA256:	eb5d609b1dcd6ab9c163c3640c06ff1cd80875592221e4d1208beb318c69ce89
Tags:	exe
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Machine Learning detection for sample

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Detected potential crypto function

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe" MD5: A4799079BC84BB2DD9A75C7121A0100E)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1651039267.0000000000642000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2900794099.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe PID: 7112	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe.640000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	ReversingLabs: Detection: 65%
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Virustotal: Detection: 58%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Source:	Binary string: costura.costura.pdb.compressed source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Source:	Binary string: C:\Users\xmoe\Desktop\KrkrExtract\KrkrExtract\KrkrExtract.Lite\obj\Release\KrkrExtract.Lite.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901607674.00000000053D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com9
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_00C1E21C	0_2_00C1E21C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_02AD84B8	0_2_02AD84B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_02AD02A0	0_2_02AD02A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_02AD0290	0_2_02AD0290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_02AD84AA	0_2_02AD84AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_051B7257	0_2_051B7257
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_051B7268	0_2_051B7268
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_0766C748	0_2_0766C748
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_076647F8	0_2_076647F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_076655B0	0_2_076655B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_07668CE0	0_2_07668CE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_0766C739	0_2_0766C739
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_07660560	0_2_07660560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_07660556	0_2_07660556
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_076655B0	0_2_076655B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_07668CD6	0_2_07668CD6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_07666BB8	0_2_07666BB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_076647F8	0_2_076647F8

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2899884302.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Binary or memory string: OriginalFilenameKrkrExtract.Lite.exeB vs SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal72.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Mutant created: NULL

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	ReversingLabs: Detection: 65%
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Virustotal: Detection: 58%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Source:	Binary string: costura.costura.pdb.compressed source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Source:	Binary string: C:\Users\xmoe\Desktop\KrkrExtract\KrkrExtract\KrkrExtract.Lite\obj\Release\KrkrExtract.Lite.pdb source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, AssemblyLoader.cs

.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1651039267.0000000000642000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2900794099.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe PID: 7112, type: MEMORYSTR

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: 0x92DBB46E [Wed Jan 29 00:55:10 2048 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_00C1D5DA pushad ; ret	0_2_00C1D5E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_00C1D640 pushfd ; ret	0_2_00C1D641
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_02ADD498 pushfd ; retf	0_2_02ADD499
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_07663D61 push esp; retf	0_2_07663D6D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Code function: 0_2_076679D8 push esp; ret	0_2_076679E5

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Static PE information: section name: .text entropy: 7.959425604299709

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Memory allocated: C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, LoaderHelper.cs	Reference to suspicious API methods: GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryW")
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, LoaderHelper.cs	Reference to suspicious API methods: GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryW")
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, LoaderHelper.cs	Reference to suspicious API methods: VirtualAllocEx(Process.hProcess, IntPtr.Zero, 4096u, AllocationType.Commit \| AllocationType.Reserve, MemoryProtection.ExecuteReadWrite)
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, LoaderHelper.cs	Reference to suspicious API methods: WriteProcessMemory(Process.hProcess, intPtr, array, array.Length, out var lpNumberOfBytesWritten)
Source: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, Processes.cs	Reference to suspicious API methods: OpenProcess(ProcessAccessFlags.QueryLimitedInformation, bInheritHandle: false, procId)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Software Packing	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	66%	ReversingLabs	Win32.Trojan.Tnega
SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	58%	Virustotal		Browse
SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	100%	Avira	PUA/Agent.chvcd
SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers?	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com9	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901607674.00000000053D4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers/frere-user.html	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.sakkal.com	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe, 00000000.00000002.2901837860.0000000006DA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430188
Start date and time:	2024-04-23 09:29:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Detection:	MAL
Classification:	mal72.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 30 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.951180953803567
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
File size:	534'016 bytes
MD5:	a4799079bc84bb2dd9a75c7121a0100e
SHA1:	c84b87b3af74643cd6b46e701090472ea105994c
SHA256:	eb5d609b1dcd6ab9c163c3640c06ff1cd80875592221e4d1208beb318c69ce89
SHA512:	270c34e16e9e87ebee9d24004f2b501aac43e2e7026b187a95508a30b62dd7ece32ec01e8cdaffa48003ad7915239a4a062f3c7f60f89b3aa57458ff006b5942
SSDEEP:	12288:MCYoBipKZdfrXg+JwuKt/S/60pFx8nRbxMhkjo5Bda7EeVJvrhh:MCYoBipKfw+Jwz/S/688nVW6k5BkAeV9
TLSH:	7CB4234133989021EB6E3FB848F60A199571E31BC457F7DE89152A2E67273CB4D30B7A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.................0......J........... ........@.. ....................................`................................

File Icon


Icon Hash:	e6f0e8d0d0cea0e3

Static PE Info

General

Entrypoint:	0x47f8be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x92DBB46E [Wed Jan 29 00:55:10 2048 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7f870	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x4730	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7f7c0	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7d8c4	0x7da00	efd8f7f16d0dcea24a7e3c0b760ca426	False	0.9498076026119403	data	7.959425604299709	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0x4730	0x4800	f1adc448dbd240f35fae09a943347190	False	0.9215494791666666	data	7.779092187080841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0xc	0x200	ce98923bea123d2abc03d1e88d6afb01	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x80100	0x409d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9779940753279729
RT_GROUP_ICON	0x841b0	0x14	data	1.05
RT_VERSION	0x841d4	0x35c	data	0.40581395348837207
RT_MANIFEST	0x84540	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exePID: 7112, Parent PID: 2580

General

Target ID:	0
Start time:	09:29:57
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe"
Imagebase:	0x640000
File size:	534'016 bytes
MD5 hash:	A4799079BC84BB2DD9A75C7121A0100E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1651039267.0000000000642000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2900794099.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exePID: 7112, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.9%
Total number of Nodes:	204
Total number of Limit Nodes:	15

Executed Functions

Function 02AD84B8 Relevance: 4.6, Strings: 3, Instructions: 881
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

", xrefs: 02AD8997
P, xrefs: 02AD8EC2
", xrefs: 02AD8A73

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "$"$P
API String ID: 0-4080636364
Opcode ID: 0c695520aa828f66d525319aece18c63528c0a3348fb4d263a711ac9c336245a
Instruction ID: 2873bc720dfe5abc23e098a8cf9da017c43854fd50f88d4042d02b4b9d7e95dc
Opcode Fuzzy Hash: 0c695520aa828f66d525319aece18c63528c0a3348fb4d263a711ac9c336245a
Instruction Fuzzy Hash: 44823930A40705CFC729EB74C954A9AB7B3BF89304F504AADD01A6B364DF75A986CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02AD84AA Relevance: 4.6, Strings: 3, Instructions: 880
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

", xrefs: 02AD8997
P, xrefs: 02AD8EC2
", xrefs: 02AD8A73

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "$"$P
API String ID: 0-4080636364
Opcode ID: 6728202747e7423d6818017f232e01c8223b888c81921fa36f8f895146831e76
Instruction ID: 3f91b3c8efa4f7850021cef825ba63e53f57e6d6e148a86608c62a70bb690d64
Opcode Fuzzy Hash: 6728202747e7423d6818017f232e01c8223b888c81921fa36f8f895146831e76
Instruction Fuzzy Hash: DD824930A40705CFC729EB74C954A9AB7B3BF89304F504AADD05A6B364DF35A986CF81

Uniqueness

Uniqueness Score: -1.00%

Function 076647F8 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d36a27f158d8d024fe0d9da0152d71bc6eda686a5c8739bac6e648a3b68f0ec
Instruction ID: 94e78c0ad3d2982005d2f72684a5644d2ec08cc34b0d8591d5116296f6f5a8db
Opcode Fuzzy Hash: 7d36a27f158d8d024fe0d9da0152d71bc6eda686a5c8739bac6e648a3b68f0ec
Instruction Fuzzy Hash: E6525D75A10659CFCB25DF74C844AE9BBB1FF49304F5485D9E40AAB261EB31EA82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 076655B0 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f124dd77adad67cabf62c9910c1d8eacef43b764c4cba51e9cbd785ae3a3fe73
Instruction ID: a11c50b6835dca2555f13f20edfaa0c9402f0f038d138159e4c1f97b106fdafc
Opcode Fuzzy Hash: f124dd77adad67cabf62c9910c1d8eacef43b764c4cba51e9cbd785ae3a3fe73
Instruction Fuzzy Hash: 32323B71A10619CFDB25DF64C949BD9B7B2FF49300F5085A9E40AAB221EB71EA85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0766C748 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d7e11b2d3f3d70ddf595a8ccd81381c3010db5f466ccf37d1d817873f7be97
Instruction ID: a6946edf69f44a7cd822e32af4175abdbd9841c94fe89a05f202797e8a080ec3
Opcode Fuzzy Hash: a0d7e11b2d3f3d70ddf595a8ccd81381c3010db5f466ccf37d1d817873f7be97
Instruction Fuzzy Hash: 8A22E635910A69DFDB21CF51C844BDAF7B2FF89300F1185DAE948AB220E771AA95CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0766C739 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06213e4fc45a074091f81294dd3220cd75bfe98fd07aeaf247a723b4d77d03ce
Instruction ID: 3e97797c420aa5618cd4fb80fa3901c3257a65d85d6a7cafb8805d91864e1ed8
Opcode Fuzzy Hash: 06213e4fc45a074091f81294dd3220cd75bfe98fd07aeaf247a723b4d77d03ce
Instruction Fuzzy Hash: B3E1F735910669DFDB22CF90CC44BDABBB2FF49300F1185DAE5086B260E771AA95DF81

Uniqueness

Uniqueness Score: -1.00%

Function 07668CD6 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6684cf9c921158226c93cae137ef5aa80daf7cea0cdb43cf62dc591a5d289921
Instruction ID: d9982c145e243653226f63b3f810c9e80ead7975f462de39c16b1fb2b5739eeb
Opcode Fuzzy Hash: 6684cf9c921158226c93cae137ef5aa80daf7cea0cdb43cf62dc591a5d289921
Instruction Fuzzy Hash: 06C16AB4D0021ACFDB28CF68D898B9DBBF1EF48714F548059E81AA7351D774A941CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07668CE0 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad7d3226cb4d5354cb51efc150d61ab0a64fdfee07281330db5fb62e9724fb0
Instruction ID: a1bf8b8e88129d9f3b633969354b4460ec4455ac413eca296099461d802529f6
Opcode Fuzzy Hash: 0ad7d3226cb4d5354cb51efc150d61ab0a64fdfee07281330db5fb62e9724fb0
Instruction Fuzzy Hash: 77B16AB4D0021ACFDB28CF68D888B9DBBF1EF48714F548059E81AA7351DB74A941CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D6F2 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C1D77E
GetCurrentThread.KERNEL32 ref: 00C1D7BB
GetCurrentProcess.KERNEL32 ref: 00C1D7F8
GetCurrentThreadId.KERNEL32 ref: 00C1D851

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d988187a6f69630c403318699d9937e657e05e931ae514edb743d753a017c6fe
Instruction ID: ceaeb1ceb4603d1346923beea1d1a4a1fd62efe7a8411d7da0e81427a710f89a
Opcode Fuzzy Hash: d988187a6f69630c403318699d9937e657e05e931ae514edb743d753a017c6fe
Instruction Fuzzy Hash: 485187B09002498FDB18DFA9D588BDEBFF1AF49308F24C4A9E059A72A0C7745985CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D700 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C1D77E
GetCurrentThread.KERNEL32 ref: 00C1D7BB
GetCurrentProcess.KERNEL32 ref: 00C1D7F8
GetCurrentThreadId.KERNEL32 ref: 00C1D851

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ee702251e1ee18bc295d486fb0d100a153fe63b64a85dc70d46d78b4d3f24a24
Instruction ID: 5ba5dbaa5a208ee9ab4436033e1ccea4f35e339268cc16c1fa910bbedf5dcc37
Opcode Fuzzy Hash: ee702251e1ee18bc295d486fb0d100a153fe63b64a85dc70d46d78b4d3f24a24
Instruction Fuzzy Hash: 505179B09006498FDB18DFA9D588BDEBBF1EF49318F20C469E019A73A0D7749984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02AD38D8 Relevance: 5.0, APIs: 3, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9685b66bc6c577c10b9ec6e4d2cda9dfb9ee725af2e894da9c17f5e950c788a7
Instruction ID: 770d4b9e10097895a1b852a9cde7bef2cac49803f8394bd8bf062a46ca2d44d4
Opcode Fuzzy Hash: 9685b66bc6c577c10b9ec6e4d2cda9dfb9ee725af2e894da9c17f5e950c788a7
Instruction Fuzzy Hash: 5C221D74A04205CFDF14DF98D5C9AAEB7B2EB88314F248196D913A7365CF349885CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B459 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C1B6BE

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 161d910055ec45434c4de32ce5c2e86ba0b50836e34a57eaded0092a89986e08
Instruction ID: cd5b84d2a0fd3f310cd14aca300ad02f2a85857a75b68b8265af90b8022989cb
Opcode Fuzzy Hash: 161d910055ec45434c4de32ce5c2e86ba0b50836e34a57eaded0092a89986e08
Instruction Fuzzy Hash: A98135B0A00B058FD724DF29D45179ABBF2BF89300F108A2DE496D7A50E775E989DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C15CEC Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C15DA9

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 44fa3e6f3ce4226001edd64411dbdad782e11dae136258fe6b152f6376bea1ef
Instruction ID: d99b5f11bd02895d9f57b75f9d9ad5225ca958b38aec4d17fc5ddfaacf451271
Opcode Fuzzy Hash: 44fa3e6f3ce4226001edd64411dbdad782e11dae136258fe6b152f6376bea1ef
Instruction Fuzzy Hash: C45103B1C00719CEDB24DFA9C8447DDBBF5AF89304F2480AAD458AB291D7756A86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02AD1F46 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02AD2062

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 50ea95ab34f1c12055c39ae7cd151c77e85d1387df529e4fbbbfe5278b0a81cb
Instruction ID: 2e10da3343c710da621a64b66dd08511fc6a05a831ff2330e7920c55fa970f14
Opcode Fuzzy Hash: 50ea95ab34f1c12055c39ae7cd151c77e85d1387df529e4fbbbfe5278b0a81cb
Instruction Fuzzy Hash: 3A51DDB1D00348DFDB14CFA9C884ADEBFB1BF88304F64812AE819AB215D7719885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02AD1F50 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02AD2062

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c531ae681e13fc5e45a512bd36ac0894700645298fb08c106f5f6a34b4fb7763
Instruction ID: 5177fd3baccd9c91417bbbd0fbc785a74c7e109858748a76cf5e3031940e98d0
Opcode Fuzzy Hash: c531ae681e13fc5e45a512bd36ac0894700645298fb08c106f5f6a34b4fb7763
Instruction Fuzzy Hash: 8A41C0B1D00349DFDB14CFA9C884ADEBFB5BF88314F64812AE819AB214D7759845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02AD148C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02AD45D1

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2017adbedb112cc97b5e44a6ac9b80848363f9fc824672ee3e702c49c0253a9a
Instruction ID: f10fb3fd5a1f76d879b5ecec19a6cf5e908bb04fc9efee168b4dd10fe6e2a9de
Opcode Fuzzy Hash: 2017adbedb112cc97b5e44a6ac9b80848363f9fc824672ee3e702c49c0253a9a
Instruction Fuzzy Hash: D641F9B4900305DFCB54CF99C488AAABBF5FB88314F24C459D51AAB321D775A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C14808 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C15DA9

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 53b7dd65f9c1bde18ecfc6c367b219affdc5cd6ed23b3ad847e4d635e55dd4e1
Instruction ID: 0a6c1511f101eb00cfadfa3d8d4d4c4127765e8473589b1d42b9ab64684b55d4
Opcode Fuzzy Hash: 53b7dd65f9c1bde18ecfc6c367b219affdc5cd6ed23b3ad847e4d635e55dd4e1
Instruction Fuzzy Hash: 6241E5B0D00719CFDB24DF99C9447DDBBB5BF89304F20806AD418AB255DB756985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D940 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C1D9CF

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e1717971044b7b79664a45662fb91eb6346999716dfd5f925804e49ceb2d936c
Instruction ID: 8d68f844f172086b606291f91e1199fe39cb1c35afb8918355ceb5969a3832eb
Opcode Fuzzy Hash: e1717971044b7b79664a45662fb91eb6346999716dfd5f925804e49ceb2d936c
Instruction Fuzzy Hash: 0D2116B59002499FDB10CFA9D584AEEFFF4EF49310F14805AE854A7350D375A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D948 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C1D9CF

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a950958f4fc34a16ed68a93cd86d7dad9e3827a8a0f6aa8c22e76dc4a1b3df9f
Instruction ID: aae082360dcb0bbe90c8ecd02d7571edb71ffaa3a6f22d237ecbef6703400632
Opcode Fuzzy Hash: a950958f4fc34a16ed68a93cd86d7dad9e3827a8a0f6aa8c22e76dc4a1b3df9f
Instruction Fuzzy Hash: 3921D5B59002599FDB10CF9AD584ADEFFF4FB48310F14841AE954A7350D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B138 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C1B739,00000800,00000000,00000000), ref: 00C1B94A

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8b889b6a362cc9c27f33d837efba373646c73f4ec588a2cfb27de19351012822
Instruction ID: bbaed9c05dd15dedfb384cccc06422db25e03370389c6741ef9fe629c800d738
Opcode Fuzzy Hash: 8b889b6a362cc9c27f33d837efba373646c73f4ec588a2cfb27de19351012822
Instruction Fuzzy Hash: 5D1126B6D003499FDB10CF9AD484ADEFBF4EB89320F10842AE559B7210C375A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B8D9 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C1B739,00000800,00000000,00000000), ref: 00C1B94A

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 796836de61810ab0a652dbffdbf5ffc78887fc5f25b2ab58d0eaaf22c3801ca3
Instruction ID: 2aa0b03e33b907db07b92784210075078eb8530ef2531403c32a6e0ca9fa607b
Opcode Fuzzy Hash: 796836de61810ab0a652dbffdbf5ffc78887fc5f25b2ab58d0eaaf22c3801ca3
Instruction Fuzzy Hash: 031126B6D003498FCB14CF9AD484ADEFBF4EF88320F10842AE559A7210C379A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B658 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C1B6BE

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: acdfa97386bde21815d5f9c05aece7c8dfed0bcd7dc5dea8990fbed451e1ca45
Instruction ID: c8c99829dd4f6b75cfe6f574cdd0dec4a13f4483761fbf9bec2a7b85be279ea1
Opcode Fuzzy Hash: acdfa97386bde21815d5f9c05aece7c8dfed0bcd7dc5dea8990fbed451e1ca45
Instruction Fuzzy Hash: 5711F5B5C003498FCB14CF9AD444ADEFBF4EF89314F10841AD469A7610D375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02AD2190 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02AD21F5

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: ee86fd4a635d7f374b60885a05b84363e03b115b934d1e4e171146c692472e0d
Instruction ID: 9d2b04e163de7848a58d36cd46aaab661eddf9ef6649b6deec01bd4f93f093e3
Opcode Fuzzy Hash: ee86fd4a635d7f374b60885a05b84363e03b115b934d1e4e171146c692472e0d
Instruction Fuzzy Hash: BE1133B58002498FDB20CF9AC985BDEFFF8EB48324F10845AE958B3200C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02AD2198 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02AD21F5

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 0cb6ecfeb7a4ac38db75d1248b1b23337f9087ff7d1b13b77ebbca31e900d5b9
Instruction ID: 8772f1d64c169009fc560cf9fa7e2b719a45e31490e85ae38b1e87b59843ddf3
Opcode Fuzzy Hash: 0cb6ecfeb7a4ac38db75d1248b1b23337f9087ff7d1b13b77ebbca31e900d5b9
Instruction Fuzzy Hash: D21103B58002488FDB10CF9AD584BDEFBF8EB48324F10841AE959A7240C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899654294.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990a1ba393b91218712f7148d4fef7fd2f9ea5782b5a9bddd88db0955236f7c0
Instruction ID: 02cb5319191c1c038df7259befb28442ade10ab4f91d250430d2502668f0afc4
Opcode Fuzzy Hash: 990a1ba393b91218712f7148d4fef7fd2f9ea5782b5a9bddd88db0955236f7c0
Instruction Fuzzy Hash: C721F279604200DFCB14DF18D9D4F26BBA5FB84314F20C5BDD84A4B296C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899654294.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0baefa7402dbaee4c89539907320a2fdfddeff2f67c511239176aac8f519a7a
Instruction ID: fc2583180a1f075e6b90a27914f65df16cedfcf8e4a0d146080a6ef3ea8297c8
Opcode Fuzzy Hash: b0baefa7402dbaee4c89539907320a2fdfddeff2f67c511239176aac8f519a7a
Instruction Fuzzy Hash: 6021C279604204EFDB05DF14D9C4F26BBA5FB84314F24C6BDE9494F296C336D846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD2D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899654294.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10033704870f7c1dcef04ffaf169b93776eca173bd96e9aa455b018bb5157c3a
Instruction ID: 5c3a03c0a77014b413fdd107e2ce4368180636ed9f27aa28b5560a9048b22515
Opcode Fuzzy Hash: 10033704870f7c1dcef04ffaf169b93776eca173bd96e9aa455b018bb5157c3a
Instruction Fuzzy Hash: B621F2B9604280DFDB019F14D9C0F2ABBA5FBC4314F24C6BDD8094B256C33AD846C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899654294.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e517950672f950348ed78f34663b5b562a896c884bfa74ab9d2204fd5b54191
Instruction ID: 0a70eb481d9c5fede5a408c845d429afad0ed33c3c546964da2aad299f2548a9
Opcode Fuzzy Hash: 8e517950672f950348ed78f34663b5b562a896c884bfa74ab9d2204fd5b54191
Instruction Fuzzy Hash: 6521A4795093808FCB12CF24D594B15BFB1EB45314F28C5EED8498B697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899654294.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 97db473e314b700b86696e84024d815658e6e16cdaee8845987cd93f5fe340d2
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E0118B7A604280DFDB16CF14D9C4B15BBA1FB84314F24C6AED8494F696C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD2CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899654294.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: cb523e5094a50ae4ca0d8731180d403fd2703ef1312f94dc0e5e554939ba31ba
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: D9119079504280DFDB12CF14D5C4B19BBA1FB84324F24C6AED8494B656C33AD80ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07666BB8 Relevance: 3.3, Strings: 2, Instructions: 803COMMON

Download Yara Rule

Strings

G, xrefs: 07667566
, xrefs: 07666C31

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $G
API String ID: 0-3730614887
Opcode ID: 080d0135a1bd9a6f5cb26117d663425e2aa074ea8c9879f19c0b98ac72930aef
Instruction ID: 1c97c1e6820c86c25ee2e7d9e3ce239e7c2e8b395c8c278711a890a10a8331b2
Opcode Fuzzy Hash: 080d0135a1bd9a6f5cb26117d663425e2aa074ea8c9879f19c0b98ac72930aef
Instruction Fuzzy Hash: 92822975A10219CFCB25DF64C858B99B7B2FF89304F5581A9E40AAB361DB31AE85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07660560 Relevance: 1.9, Strings: 1, Instructions: 693COMMON

Download Yara Rule

Strings

fff?, xrefs: 07660BC7

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: ec8307ae516faa2c46bfdc15397a6002ff058e745ede4f3b6c7fab8d4666c8d4
Instruction ID: d3280d62badea7fa422ff5e7b4fc168d004487bd4ed5da7a575ad923e9d528e0
Opcode Fuzzy Hash: ec8307ae516faa2c46bfdc15397a6002ff058e745ede4f3b6c7fab8d4666c8d4
Instruction Fuzzy Hash: 9A626A36810A1ADFCF11DF50C888AD9B7B2FF99300F1586D5E9096B121EB71AAD5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 07660556 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

fff?, xrefs: 07660BC7

Memory Dump Source

Source File: 00000000.00000002.2902255466.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7660000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: e650e04e33594418f48ed7f7f6249b11e217edc8af94f100ec0857bfd0f3f928
Instruction ID: 6807a36d5f848bcdf6dda23385f03f7b8febdc1d156097403302b28fc2184d30
Opcode Fuzzy Hash: e650e04e33594418f48ed7f7f6249b11e217edc8af94f100ec0857bfd0f3f928
Instruction Fuzzy Hash: 8A125C76900619DFCF11DF50C888AD9BBB2FF49300F1585E5E8096B266EB719E96CF80

Uniqueness

Uniqueness Score: -1.00%

Function 02AD02A0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4504e836392f50b7e722ae595a2071f00d07b76c7e6615d6c7f1e58854ad9e4e
Instruction ID: b774784f00d7be950a547f3b86411181071ed5b4ab2a05fba5856fa765f4d08e
Opcode Fuzzy Hash: 4504e836392f50b7e722ae595a2071f00d07b76c7e6615d6c7f1e58854ad9e4e
Instruction Fuzzy Hash: C51293B44017458AD3B8CF65E94C18D7BB6FB41328B90C329DA752A2E9DBB815CBCF44

Uniqueness

Uniqueness Score: -1.00%

Function 051B7257 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2901344426.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51b0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64ffc7af6b2197634be015e265f6d09af1ead8ab0729e25bda761a307956dc8
Instruction ID: 410417a9da7ee01f4e1ea0b32d1900d1d70102f86aa94fe808d5631fba1c47db
Opcode Fuzzy Hash: e64ffc7af6b2197634be015e265f6d09af1ead8ab0729e25bda761a307956dc8
Instruction Fuzzy Hash: 06D1FA31D2075ACACB10EBA4D990A9DB7B1FF95300F50C79AD4093B615EB70AAC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E21C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899817663.0000000000C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b4731699bf7fe121f41e2eafef89c843ebd5afe94b3474f0bff2167e58497e
Instruction ID: d22ba40b4d2ad72be07a5590a6fed05c313783a785ecf4e30582d48466de4129
Opcode Fuzzy Hash: f0b4731699bf7fe121f41e2eafef89c843ebd5afe94b3474f0bff2167e58497e
Instruction Fuzzy Hash: 62A18C32E002158FCF09DFB5C8505DEB7B2FF86300B15857AE815AB265DB71E996EB40

Uniqueness

Uniqueness Score: -1.00%

Function 051B7268 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2901344426.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_51b0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab0fadc6c729ce505ead8aa819414ac8fc1070af99df1a3c2fc5c87603edebc
Instruction ID: 8bd4a0d72206fe9895b568ca77be3d99f779247538208c2742c95a4d8ab7a86f
Opcode Fuzzy Hash: 6ab0fadc6c729ce505ead8aa819414ac8fc1070af99df1a3c2fc5c87603edebc
Instruction Fuzzy Hash: 06D1E931D2075ACACB10EBA4D990A9DB7B1FF95300F50C79AD4093B615EB70AAC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02AD0290 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900698494.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352612aeed92394e79ee079acd17c730ab07e7ceaabd73b9eb7740479ef9c31a
Instruction ID: 3c5b9c55523ac3d520cb5052ed54b1d2ec4178f7ad84fd740f3b76c490ea4743
Opcode Fuzzy Hash: 352612aeed92394e79ee079acd17c730ab07e7ceaabd73b9eb7740479ef9c31a
Instruction Fuzzy Hash: 7FC1F5B08007468AD7A8CF65E84818D7BB6FB85328F50C329D9716B6E9DBB415CBCF44

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exePID: 7112, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exePID: 7112, Parent PID: 2580COMMON

Execution Graph

Windows Analysis Report
SecuriteInfo.com.Win32.TrojanX-gen.31945.28890.exe

Function 02AD84B8 Relevance: 4.6, Strings: 3, Instructions: 881
COMMON

Function 02AD84AA Relevance: 4.6, Strings: 3, Instructions: 880
COMMON

Function 00C1D6F2 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Function 00C1D700 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON