Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1430821
MD5: 2019322ea56c5b80294770f6018bddc1
SHA1: 19285ecd68a4d9b957f87502c555dad437cfeb8f
SHA256: 0823c2f58d094e1c096ae9184acf0b930df6dff97d0cd77728dc3ff07f9c0096
Tags: exe
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Machine Learning detection for dropped file
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Avira: detection malicious, Label: TR/Redcap.nszjr
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Avira: detection malicious, Label: TR/Redcap.nszjr
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Avira: detection malicious, Label: TR/Redcap.nszjr
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe ReversingLabs: Detection: 63%
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Virustotal: Detection: 73% Perma Link
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Virustotal: Detection: 73% Perma Link
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Virustotal: Detection: 73% Perma Link
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 63%
Source: file.exe Virustotal: Detection: 73% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Joe Sandbox ML: detected
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.66.10:50505 -> 192.168.2.5:49704
Source: Traffic Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49704 -> 5.42.66.10:50505
Source: Traffic Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49704 -> 5.42.66.10:50505
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 5.42.66.10:50505
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 5.42.66.10 5.42.66.10
Source: Joe Sandbox View IP Address: 5.42.66.10 5.42.66.10
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: file.exe, 00000000.00000002.3271675372.0000000000F0F000.00000002.00000001.01000000.00000003.sdmp, WinTrackerSP.exe, 00000006.00000002.2070340536.0000000000DDF000.00000002.00000001.01000000.00000006.sdmp, WinTrackerSP.exe, 00000007.00000002.2071240449.0000000000DDF000.00000002.00000001.01000000.00000006.sdmp, ExtreamFanV5.exe, 0000000B.00000002.2207185054.000000000020F000.00000002.00000001.01000000.00000007.sdmp, ExtreamFanV5.exe, 0000000F.00000002.2268199142.000000000020F000.00000002.00000001.01000000.00000007.sdmp, PowerExpertNT.exe, 00000012.00000002.2343560739.000000000052F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000002.3271675372.0000000000F0F000.00000002.00000001.01000000.00000003.sdmp, WinTrackerSP.exe, 00000006.00000002.2070340536.0000000000DDF000.00000002.00000001.01000000.00000006.sdmp, WinTrackerSP.exe, 00000007.00000002.2071240449.0000000000DDF000.00000002.00000001.01000000.00000006.sdmp, ExtreamFanV5.exe, 0000000B.00000002.2207185054.000000000020F000.00000002.00000001.01000000.00000007.sdmp, ExtreamFanV5.exe, 0000000F.00000002.2268199142.000000000020F000.00000002.00000001.01000000.00000007.sdmp, PowerExpertNT.exe, 00000012.00000002.2343560739.000000000052F000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.winimage.com/zLibDllm_object
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe 0823C2F58D094E1C096AE9184ACF0B930DF6DFF97D0CD77728DC3FF07F9C0096
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe 0823C2F58D094E1C096AE9184ACF0B930DF6DFF97D0CD77728DC3FF07F9C0096
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe 0823C2F58D094E1C096AE9184ACF0B930DF6DFF97D0CD77728DC3FF07F9C0096
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.evad.winEXE@15/8@0/1
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\ExtreamFanV5 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Mutant created: \Sessions\1\BaseNamedObjects\IntelPowerExpert
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:652:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7092:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\tmpSTLpopstart Jump to behavior
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe ReversingLabs: Detection: 63%
Source: file.exe Virustotal: Detection: 73%
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe C:\ProgramData\WinTrackerSP\WinTrackerSP.exe
Source: unknown Process created: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe C:\ProgramData\WinTrackerSP\WinTrackerSP.exe
Source: unknown Process created: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe "C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe "C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe "C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe "C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe "C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe "C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32 Jump to behavior
Source: PowerExpertNT.lnk.0.dr LNK file: ..\..\..\..\..\..\Local\Temp\PowerExpertNT\PowerExpertNT.exe
Source: file.exe Static file information: File size 5857792 > 1048576
Source: file.exe Static PE information: Raw size of .vmp1024 is bigger than: 0x100000 < 0x593400
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .vmp1024
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name: .vmp1024
Source: file.exe Static PE information: section name: .vmp1024
Source: ExtreamFanV5.exe.0.dr Static PE information: section name: .vmp1024
Source: ExtreamFanV5.exe.0.dr Static PE information: section name: .vmp1024
Source: PowerExpertNT.exe.0.dr Static PE information: section name: .vmp1024
Source: PowerExpertNT.exe.0.dr Static PE information: section name: .vmp1024
Source: WinTrackerSP.exe.0.dr Static PE information: section name: .vmp1024
Source: WinTrackerSP.exe.0.dr Static PE information: section name: .vmp1024
Drops PE files
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\file.exe File created: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV5 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV5 Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Users\user\Desktop\file.exe Memory written: PID: 2508 base: 1940005 value: E9 8B 2F 5B 75 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: PID: 2508 base: 76EF2F90 value: E9 7A D0 A4 8A Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Memory written: PID: 5732 base: 1CA0005 value: E9 8B 2F 25 75 Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Memory written: PID: 5732 base: 76EF2F90 value: E9 7A D0 DA 8A Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Memory written: PID: 3524 base: A60005 value: E9 8B 2F 49 76 Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Memory written: PID: 3524 base: 76EF2F90 value: E9 7A D0 B6 89 Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Memory written: PID: 6404 base: 10B0005 value: E9 8B 2F E4 75 Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Memory written: PID: 6404 base: 76EF2F90 value: E9 7A D0 1B 8A Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Memory written: PID: 4112 base: 12A0005 value: E9 8B 2F C5 75 Jump to behavior
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Memory written: PID: 4112 base: 76EF2F90 value: E9 7A D0 3A 8A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Memory written: PID: 5480 base: 440005 value: E9 8B 2F AB 76 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Memory written: PID: 5480 base: 76EF2F90 value: E9 7A D0 54 89 Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: file.exe, 00000000.00000002.3271713510.0000000000F2A000.00000020.00000001.01000000.00000003.sdmp, WinTrackerSP.exe, 00000006.00000002.2070389474.0000000000DFA000.00000020.00000001.01000000.00000006.sdmp, WinTrackerSP.exe, 00000007.00000002.2071295908.0000000000DFA000.00000020.00000001.01000000.00000006.sdmp, ExtreamFanV5.exe, 0000000B.00000002.2207221346.000000000022A000.00000020.00000001.01000000.00000007.sdmp, ExtreamFanV5.exe, 0000000F.00000002.2268272008.000000000022A000.00000020.00000001.01000000.00000007.sdmp, PowerExpertNT.exe, 00000012.00000002.2343606376.000000000054A000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: R.SBIEDLL.DLL>3
Source: file.exe, 00000000.00000002.3271713510.0000000000F2A000.00000020.00000001.01000000.00000003.sdmp, WinTrackerSP.exe, 00000006.00000002.2070389474.0000000000DFA000.00000020.00000001.01000000.00000006.sdmp, WinTrackerSP.exe, 00000007.00000002.2071295908.0000000000DFA000.00000020.00000001.01000000.00000006.sdmp, ExtreamFanV5.exe, 0000000B.00000002.2207221346.000000000022A000.00000020.00000001.01000000.00000007.sdmp, ExtreamFanV5.exe, 0000000F.00000002.2268272008.000000000022A000.00000020.00000001.01000000.00000007.sdmp, PowerExpertNT.exe, 00000012.00000002.2343606376.000000000054A000.00000020.00000001.01000000.00000009.sdmp Binary or memory string: R.SBIEDLL.DLL
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 1672 Thread sleep count: 41 > 30 Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1672 Thread sleep count: 39 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\file.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: file.exe, 00000000.00000002.3272728136.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430821 Sample: file.exe Startdate: 24/04/2024 Architecture: WINDOWS Score: 100 34 Snort IDS alert for network traffic 2->34 36 Antivirus / Scanner detection for submitted sample 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Machine Learning detection for sample 2->40 7 file.exe 1 13 2->7         started        12 WinTrackerSP.exe 2->12         started        14 ExtreamFanV5.exe 2->14         started        16 6 other processes 2->16 process3 dnsIp4 32 5.42.66.10, 49704, 50505 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 7->32 26 C:\Users\user\AppData\...\PowerExpertNT.exe, PE32 7->26 dropped 28 C:\Users\user\AppData\...xtreamFanV5.exe, PE32 7->28 dropped 30 C:\ProgramData\...\WinTrackerSP.exe, PE32 7->30 dropped 42 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->42 44 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->44 46 Uses schtasks.exe or at.exe to add and modify task schedules 7->46 18 schtasks.exe 1 7->18         started        20 schtasks.exe 1 7->20         started        48 Antivirus detection for dropped file 12->48 50 Multi AV Scanner detection for dropped file 12->50 52 Machine Learning detection for dropped file 12->52 file5 signatures6 process7 process8 22 conhost.exe 18->22         started        24 conhost.exe 20->24         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.42.66.10
 unknown Russian Federation
39493 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU true