Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
Detection
Clipboard Hijacker, RisePro Stealer
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Clipboard Hijacker
Yara detected RisePro Stealer
Contains functionality to implement multi-threaded time evasion
Creates multiple autostart registry keys
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
- file.exe (PID: 5316 cmdline:
"C:\Users\ user\Deskt op\file.ex e" MD5: E13D9AB9096DCC3BD309272DEA987462) - schtasks.exe (PID: 3280 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV2_45c48c ce2e2d7fbd ea1afc51c7 c6ad26\MSI UpdaterV2. exe" /tn " MSIUpdater V2_45c48cc e2e2d7fbde a1afc51c7c 6ad26 HR" /sc HOURLY /rl HIGHE ST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 2464 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 2512 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV2_45c48c ce2e2d7fbd ea1afc51c7 c6ad26\MSI UpdaterV2. exe" /tn " MSIUpdater V2_45c48cc e2e2d7fbde a1afc51c7c 6ad26 LG" /sc ONLOGO N /rl HIGH EST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 3700 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - IHobmyUUXF8jFZ9HHCK7.exe (PID: 3040 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\span8f TqI7Z4TQTK \IHobmyUUX F8jFZ9HHCK 7.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 4128 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 3428 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 4936 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV2_c81e72 8d9d4c2f63 6f067f89cc 14862c\MSI UpdaterV2. exe" /tn " MSIUpdater V2_c81e728 d9d4c2f636 f067f89cc1 4862c HR" /sc HOURLY /rl HIGHE ST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 3800 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 752 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV2_c81e72 8d9d4c2f63 6f067f89cc 14862c\MSI UpdaterV2. exe" /tn " MSIUpdater V2_c81e728 d9d4c2f636 f067f89cc1 4862c LG" /sc ONLOGO N /rl HIGH EST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 908 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RthubJXJJOhKyKgs0z_b.exe (PID: 6012 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\span8f TqI7Z4TQTK \RthubJXJJ OhKyKgs0z_ b.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 5372 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 5208 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MSIUpdaterV2.exe (PID: 6108 cmdline:
C:\Program Data\MSIUp daterV2_45 c48cce2e2d 7fbdea1afc 51c7c6ad26 \MSIUpdate rV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)
- MSIUpdaterV2.exe (PID: 2100 cmdline:
C:\Program Data\MSIUp daterV2_45 c48cce2e2d 7fbdea1afc 51c7c6ad26 \MSIUpdate rV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 4700 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 4584 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- oobeldr.exe (PID: 5688 cmdline:
C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C) - conhost.exe (PID: 4452 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MSIUpdaterV2.exe (PID: 4996 cmdline:
C:\Program Data\MSIUp daterV2_c8 1e728d9d4c 2f636f067f 89cc14862c \MSIUpdate rV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 5572 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 5332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MSIUpdaterV2.exe (PID: 5308 cmdline:
C:\Program Data\MSIUp daterV2_c8 1e728d9d4c 2f636f067f 89cc14862c \MSIUpdate rV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)
- AdobeUpdaterV2.exe (PID: 5588 cmdline:
"C:\Users\ user\AppDa ta\Local\A dobeUpdate rV2_45c48c ce2e2d7fbd ea1afc51c7 c6ad26\Ado beUpdaterV 2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 5856 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 5776 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- AdobeUpdaterV2.exe (PID: 7144 cmdline:
"C:\Users\ user\AppDa ta\Local\A dobeUpdate rV2_c81e72 8d9d4c2f63 6f067f89cc 14862c\Ado beUpdaterV 2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 2976 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 3984 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- AdobeUpdaterV2.exe (PID: 3456 cmdline:
"C:\Users\ user\AppDa ta\Local\A dobeUpdate rV2_45c48c ce2e2d7fbd ea1afc51c7 c6ad26\Ado beUpdaterV 2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 5576 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 4128 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- AdobeUpdaterV2.exe (PID: 5704 cmdline:
"C:\Users\ user\AppDa ta\Local\A dobeUpdate rV2_c81e72 8d9d4c2f63 6f067f89cc 14862c\Ado beUpdaterV 2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 7088 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 1996 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- EdgeMS2.exe (PID: 1108 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\EdgeMS 2_45c48cce 2e2d7fbdea 1afc51c7c6 ad26\EdgeM S2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 6052 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 1984 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- oobeldr.exe (PID: 2852 cmdline:
C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C) - schtasks.exe (PID: 6012 cmdline:
/C /create /F /sc mi nute /mo 1 /tn "Tele metry Logg ing" /tr " C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Protect\oo beldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 6552 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Windows_Trojan_Clipbanker_f9f9e79d | unknown | unknown |
| |
Windows_Trojan_Clipbanker_787b130b | unknown | unknown |
| |
JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
Windows_Trojan_Clipbanker_f9f9e79d | unknown | unknown |
| |
Click to see the 32 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Clipboard_Hijacker | Yara detected Clipboard Hijacker | Joe Security | ||
Windows_Trojan_Clipbanker_f9f9e79d | unknown | unknown |
| |
Windows_Trojan_Clipbanker_787b130b | unknown | unknown |
| |
JoeSecurity_Clipboard_Hijacker | Yara detected Clipboard Hijacker | Joe Security | ||
Windows_Trojan_Clipbanker_f9f9e79d | unknown | unknown |
| |
Click to see the 34 entries |
System Summary |
---|
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
Source: | Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Timestamp: | 04/24/24-14:43:00.371414 |
SID: | 2049060 |
Source Port: | 49707 |
Destination Port: | 50500 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 04/24/24-14:43:15.026610 |
SID: | 2019714 |
Source Port: | 49710 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 04/24/24-14:43:01.053353 |
SID: | 2046267 |
Source Port: | 50500 |
Destination Port: | 49707 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 04/24/24-14:43:00.696309 |
SID: | 2046266 |
Source Port: | 50500 |
Destination Port: | 49707 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 04/24/24-14:43:03.189289 |
SID: | 2046268 |
Source Port: | 49707 |
Destination Port: | 50500 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Code function: | 0_2_00623EB0 |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Code function: | 0_2_006233B0 | |
Source: | Code function: | 0_2_00591F8C | |
Source: | Code function: | 0_2_0079CBCC |
Networking |
---|
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: |