Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe
Analysis ID:	1431431
MD5:	44ba489fd3a12bd062c96421145d2d2f
SHA1:	867383ba1ed8a9760c4051beb1a694fa662758f9
SHA256:	161a2f35c23c46ab65bdb91ed5cc720919b96d11fc6b9a8d2a9498d2ec35fc84
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

One or more processes crash

PE file does not import any functions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe (PID: 1072 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe" MD5: 44BA489FD3A12BD062C96421145D2D2F)

WerFault.exe (PID: 6440 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 232 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Virustotal: Detection: 19%

Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: Http://ptlogin2.qq.com/check?uin=
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ad.23gua.com/farm.html
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ad.23gua.com/pasture.html
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://api.23gua.com/farm/key.xml
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://api.23gua.com/fy/
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://api.23gua.com/fy/QQ
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://api.23gua.com/fy/card.xml
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://api.23gua.com/fy/farm.html
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://api.23gua.com/fy/farm.htmlU
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://api.23gua.com/fy/farm.xml
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://appimg.qq.com/happyfarm/module/Main2_v_6.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://appimg.qq.com/happyfarm/module/Main2_v_9.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://appimg.qq.com/happyfarm/module/loading2_v_1.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://base.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?uins=
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://captcha.qq.com/getimage?aid=10000101&vc_type=
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ctc.appimg.qq.com/mc/module/Master2_v_5.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ctc.appimg.qq.com/mc/module/mc/main/commonui_v_5.swf?v=1
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ctc.appimg.qq.com/mc/module/mc/main/farmui1_v_25.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ctc.appimg.qq.com/mc/module/mc/main/farmui2_v_19.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.qzone.qq.com/cgi-bin/cgi_farm_buyseed?mod=repertory&act=buySeed
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.qzone.qq.com/cgi-bin/cgi_farm_getseedinfo?mod=repertory&act=getSeedInfo
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.qzone.qq.com/cgi-bin/cgi_farm_getuserseed?mod=repertory&act=getUserSeed
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.qzone.qq.com/cgi-bin/cgi_farm_ini_run_v2?v=12
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.qzone.qq.com/cgi-bin/cgi_farm_reclaim?mod=user&act=reclaim
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.qzone.qq.com/cgi-bin/cgi_farm_reclaimpay?mod=user&act=reclaimPay
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.qzone.qq.com/cgi-bin/cgi_farm_upgrade
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_attack_beast
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_getseedinfo?mod=repertory&act=getSeedInfo
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_getuserseed?mod=repertory&act=getUserSeed
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_pickup_crystal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_reclaim?mod=user&act=reclaim
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_reclaimpay?mod=user&act=reclaimPay
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_upgrade
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/animalConfig.xml
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_buy_animal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_donate_animal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_enter
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_feed_food
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_fight
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_get_Exp
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_get_animals
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_get_package
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_get_repertory?target=animal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_harvest_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_help_pasture
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_post_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_raise_cub
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_sale_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_steal_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.qzone.qq.com/cgi-bin/cgi_up_animalhouse
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/animalConfig.xml
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_buy_animal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_donate_animal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_enter
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_feed_food
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_fight
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_get_Exp
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_get_animals
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_get_repertory?target=animal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_harvest_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_post_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_raise_cub
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_sale_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://mc.xiaoyou.qq.com/cgi-bin/cgi_steal_product
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_attack_beast
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_getFriendList?mod=friend
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_getstatus_filter?cmd=3
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_getusercrop?f=1
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run&ownerId=
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=clearWeed
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=spraying
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=water
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_pickup_crystal
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=harvest
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=planting
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=scarify
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_saleall?mod=repertory&act=saleAll
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.qzone.qq.com/cgi-bin/cgi_farm_steal_v2?mod=farmlandstatus&act=scrounge
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_getFriendList?mod=friend
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_getstatus_filter?cmd=3
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_getusercrop?f=1
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run&ownerId=
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=clearWeed
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=spraying
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=water
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=harvest
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=planting
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=scarify
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_saleall?mod=repertory&act=saleAll
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_steal_v2?mod=farmlandstatus&act=scrounge
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ptlogin2.qq.com/getimage?aid=353&
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ptlogin2.qq.com/getimage?aid=353&U
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://ptlogin2.qq.com/login?u=
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://www.23gua.cm
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://www.23gua.com
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://www.23gua.comopen
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://www.23gua.comopenS3
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://www.clamav.net
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: http://www.indyproject.org/

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0047A1E4	0_2_0047A1E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004BC56C	0_2_004BC56C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0047FCE4	0_2_0047FCE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004C8E84	0_2_004C8E84
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004B2F40	0_2_004B2F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004A7F70	0_2_004A7F70

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 232

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal52.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1072

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2375f42e-1180-4ee2-8b4f-04e2b52962ad

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Virustotal: Detection: 19%

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: NATS-SEFI-ADD
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: NATS-DANO-ADD
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: jp-ocr-b-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: jp-ocr-hand-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: ISO_6937-2-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: 0=http://appimg.qq.com/happyfarm/module/loading2_v_1.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: NATS-SEFI-ADD
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: NATS-DANO-ADD
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: jp-ocr-b-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: jp-ocr-hand-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: ISO_6937-2-add
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: 0=http://appimg.qq.com/happyfarm/module/loading2_v_1.swf
Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	String found in binary or memory: 80=http://appimg.qq.com/happyfarm/module/loading2_v_1.swf

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 232

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Section loaded: apphelp.dll

Jump to behavior

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Static file information: File size 1761280 > 1048576

Source: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Static PE information: Raw size of CODE is bigger than: 0x100000 < 0x162000

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0046B058 push 0046B084h; ret	0_2_0046B07C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004C5074 push 004C50A0h; ret	0_2_004C5098
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004CD02C push 004CD0E5h; ret	0_2_004CD0DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_00434020 push 0043406Ch; ret	0_2_00434064
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004BF0CC push 004BF126h; ret	0_2_004BF11E
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004430FC push 00443128h; ret	0_2_00443120
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004D1080 push 004D10ACh; ret	0_2_004D10A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0046B090 push 0046B0BCh; ret	0_2_0046B0B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004A70B4 push 004A712Eh; ret	0_2_004A7126
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004CD108 push 004CD134h; ret	0_2_004CD12C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0048611C push 00486148h; ret	0_2_00486140
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0046B110 push 0046B13Ch; ret	0_2_0046B134
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_00430130 push 0043015Ch; ret	0_2_00430154
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004A71D8 push 004A7204h; ret	0_2_004A71FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004171D4 push 0041724Ah; ret	0_2_00417242
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0046E1EC push 0046E238h; ret	0_2_0046E230
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004551F4 push 0045525Ah; ret	0_2_00455252
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004261F8 push 004262A3h; ret	0_2_0042629B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004A7188 push 004A71B4h; ret	0_2_004A71AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0046E188 push 0046E1CBh; ret	0_2_0046E1C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_00433198 push 004331E7h; ret	0_2_004331DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004951B8 push 004951FBh; ret	0_2_004951F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0046E244 push 0046E28Fh; ret	0_2_0046E287
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0041724C push 004172F4h; ret	0_2_004172EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0045525C push 004552E9h; ret	0_2_004552E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_00458204 push 00458230h; ret	0_2_00458228
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004322C4 push 00432302h; ret	0_2_004322FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0043D2D4 push 0043D300h; ret	0_2_0043D2F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_004312DC push 00431308h; ret	0_2_00431300
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0043D284 push 0043D2B0h; ret	0_2_0043D2A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	Code function: 0_2_0043129C push 004312C8h; ret	0_2_004312C0

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Code function: 0_2_00562DC0 EntryPoint,LdrInitializeThunk,

0_2_00562DC0

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	20%	Virustotal		Browse
SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://api.23gua.com/fy/farm.htmlU	0%	Avira URL Cloud	safe
http://www.23gua.comopenS3	0%	Avira URL Cloud	safe
http://www.23gua.com	0%	Avira URL Cloud	safe
http://www.23gua.cm	0%	Avira URL Cloud	safe
http://api.23gua.com/fy/	0%	Avira URL Cloud	safe
http://ad.23gua.com/pasture.html	0%	Avira URL Cloud	safe
http://www.23gua.comopen	0%	Avira URL Cloud	safe
http://api.23gua.com/fy/farm.xml	0%	Avira URL Cloud	safe
http://api.23gua.com/fy/farm.html	0%	Avira URL Cloud	safe
http://ad.23gua.com/farm.html	0%	Avira URL Cloud	safe
http://api.23gua.com/farm/key.xml	0%	Avira URL Cloud	safe
http://api.23gua.com/fy/card.xml	0%	Avira URL Cloud	safe
http://api.23gua.com/fy/QQ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mc.qzone.qq.com/cgi-bin/cgi_sale_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_help_pasture	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_raise_cub	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ctc.appimg.qq.com/mc/module/mc/main/farmui2_v_19.swf	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_harvest_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://www.23gua.comopenS3	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://api.23gua.com/fy/farm.htmlU	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_upgrade	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_reclaim?mod=user&act=reclaim	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_get_animals	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://www.indyproject.org/	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://mc.xiaoyou.qq.com/animalConfig.xml	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_enter	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=planting	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=clearWeed	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=planting	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://appimg.qq.com/happyfarm/module/Main2_v_9.swf	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://base.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?uins=	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_donate_animal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://www.23gua.com	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://mc.qzone.qq.com/cgi-bin/cgi_donate_animal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_post_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=spraying	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://www.23gua.cm	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://nc.qzone.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=water	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://www.clamav.net	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://api.23gua.com/fy/	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://nc.qzone.qq.com/cgi-bin/cgi_farm_attack_beast	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_sale_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_saleall?mod=repertory&act=saleAll	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ptlogin2.qq.com/getimage?aid=353&U	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=scarify	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.qzone.qq.com/cgi-bin/cgi_farm_upgrade	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_enter	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_up_animalhouse	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ctc.appimg.qq.com/mc/module/mc/main/farmui1_v_25.swf	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_buy_animal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ad.23gua.com/pasture.html	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://mc.xiaoyou.qq.com/cgi-bin/cgi_steal_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_getstatus_filter?cmd=3	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_post_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://www.23gua.comopen	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://mc.xiaoyou.qq.com/cgi-bin/cgi_feed_food	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=scarify	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.qzone.qq.com/cgi-bin/cgi_farm_getseedinfo?mod=repertory&act=getSeedInfo	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_fight	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://api.23gua.com/fy/farm.xml	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://nc.qzone.qq.com/cgi-bin/cgi_farm_steal_v2?mod=farmlandstatus&act=scrounge	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://captcha.qq.com/getimage?aid=10000101&vc_type=	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.qzone.qq.com/cgi-bin/cgi_farm_buyseed?mod=repertory&act=buySeed	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_feed_food	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_get_repertory?target=animal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_fight	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.qzone.qq.com/cgi-bin/cgi_farm_reclaim?mod=user&act=reclaim	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_steal_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_pickup_crystal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://api.23gua.com/fy/farm.html	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://nc.qzone.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ctc.appimg.qq.com/mc/module/mc/main/commonui_v_5.swf?v=1	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=harvest	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_pickup_crystal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_getFriendList?mod=friend	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_getusercrop?f=1	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ad.23gua.com/farm.html	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_plant?mod=farmlandstatus&act=harvest	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run&ownerId=	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.qzone.qq.com/cgi-bin/cgi_farm_getuserseed?mod=repertory&act=getUserSeed	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_steal_v2?mod=farmlandstatus&act=scrounge	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
Http://ptlogin2.qq.com/check?uin=	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_getseedinfo?mod=repertory&act=getSeedInfo	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_raise_cub	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_saleall?mod=repertory&act=saleAll	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_attack_beast	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run&ownerId=	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://appimg.qq.com/happyfarm/module/Main2_v_6.swf	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://api.23gua.com/farm/key.xml	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://nc.qzone.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=clearWeed	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.qzone.qq.com/cgi-bin/cgi_farm_ini_run_v2?v=12	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=spraying	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_opt?mod=farmlandstatus&act=water	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/animalConfig.xml	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_getFriendList?mod=friend	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.qzone.qq.com/cgi-bin/cgi_farm_reclaimpay?mod=user&act=reclaimPay	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://upx.sf.net	Amcache.hve.4.dr	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_get_package	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://api.23gua.com/fy/card.xml	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://ptlogin2.qq.com/login?u=	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_get_animals	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ptlogin2.qq.com/getimage?aid=353&	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.qzone.qq.com/cgi-bin/cgi_harvest_product	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_getstatus_filter?cmd=3	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://ctc.appimg.qq.com/mc/module/Master2_v_5.swf	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://api.23gua.com/fy/QQ	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false	Avira URL Cloud: safe	unknown
http://nc.xiaoyou.qq.com/cgi-bin/cgi_farm_index?mod=user&act=run	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://nc.qzone.qq.com/cgi-bin/cgi_farm_getusercrop?f=1	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_getuserseed?mod=repertory&act=getUserSeed	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_buy_animal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://mc.xiaoyou.qq.com/cgi-bin/cgi_get_repertory?target=animal	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://farm.xiaoyou.qq.com/cgi-bin/cgi_farm_reclaimpay?mod=user&act=reclaimPay	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high
http://appimg.qq.com/happyfarm/module/loading2_v_1.swf	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431431
Start date and time:	2024-04-25 05:29:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe
Detection:	MAL
Classification:	mal52.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_9d50f1a2eb86aa236a701d83e0f8c17bb555f3_2ef1b157_e76709af-2bca-4fd8-aeaf-5d9a60530078\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6864404096911639
Encrypted:	false
SSDEEP:	192:9vki1cSn2L0BU/zjQjEzuiFFZ24IO8iE8J:Fki1cSn2YBU/zjQjEzuiFFY4IO8iE8J
MD5:	8316ED6580E71BB97C0C7C07323C71F2
SHA1:	8798C60A1F23947C674C3584E773608201A0DABE
SHA-256:	4E1843C1B563A5332494C481C4F7C761F7AE40713309797352BE7DF4F27A8C9D
SHA-512:	2100EF2A470EB12DC1719A48B8AE09163C47FE7100E47CDF13DE9807FF54011DC9A85C61A6C4307CD2948838FEA7F4713FE0B3C239033A61CB799F950B9098FD
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.4.8.9.4.4.2.0.4.6.6.6.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.4.8.9.4.4.2.3.5.9.1.6.7.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.6.7.0.9.a.f.-.2.b.c.a.-.4.f.d.8.-.a.e.a.f.-.5.d.9.a.6.0.5.3.0.0.7.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.3.f.5.2.a.0.4.-.a.7.e.d.-.4.7.2.3.-.a.7.8.d.-.5.f.f.3.9.8.b.c.d.8.4.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.3.2...X.p.a.c.k...E...g.e.n...E.l.d.o.r.a.d.o...1.2.0.0.2...1.3.8.9.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.3.0.-.0.0.0.1.-.0.0.1.4.-.4.8.b.1.-.1.0.f.3.c.0.9.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.7.a.7.8.e.1.8.3.8.6.c.3.4.8.4.b.0.1.0.3.2.f.2.0.1.4.4.9.4.d.b.0.0.0.0.f.f.f.f.!.0.0.0.0.8.6.7.3.8.3.b.a.1.e.d.8.a.9.7.6.0.c.4.0.5.1.b.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER866C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 25 03:30:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	18598
Entropy (8bit):	1.9643119800734063
Encrypted:	false
SSDEEP:	96:50t8HE3MvCVyoVLP8tCIi7nEKnOOYC3CCnxo6tgBWIkWIIRUI4Ggz1iF7sK4:e2L5OLkgIO3nMECCna6uqGgzcFJ4
MD5:	4C4E1A24103F9A245FFE47DF7A986F67
SHA1:	39AD340A4F70595D10C826EB0ABAA988FCFE97BE
SHA-256:	0AF49133B0825126F738B51CBCC594A7F8B6B3D6DD3030563EC384F18C8E8D2F
SHA-512:	7F3F8490171CF9462AC6BA06E953C158AFE15E9FA38643E9AB48EAB62BFACC4DEF7E893093E9F4F75C30FB78D875ACC7DE111761324C564336A9A7C58EAA4507
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......b.)f............4...............<.......T...............T.......8...........T................?......................................................................................................eJ......L.......GenuineIntel............T.......0...a.)f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER86AB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8494
Entropy (8bit):	3.702395023636562
Encrypted:	false
SSDEEP:	192:R6l7wVeJMm/w6Yma6YNbSU9Zgmf43P+prt89bDvsffBm:R6lXJMmI6M6YhSU9Zgmf4fBDUfE
MD5:	22A6156272002C2648CFEB2E42E82331
SHA1:	3240B5384CC272EF6FE43C13757652ECD52CA935
SHA-256:	9E760AA889F21C82B6B7F71A3549380EF8B579C6F21236F36BF0B27CCCF9E5BB
SHA-512:	B68EDD419374F8360979FD955159DA8D51730BC3591DBFF4847E834F3BE13FEB244F595657E5955F987C737BAC50D3BB87BD37BC9D940B8237E008C92F074DE8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER86EB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4834
Entropy (8bit):	4.58004934700169
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9PHAbHzrWpW8VYzYm8M4JmxF4+q8NlI+j3d:uIjfvI7mK7VrJ3GI+j3d
MD5:	0EBFE19DAA905E2E4B24B9657FFA9C1B
SHA1:	6DE170D407CE0DD5C0C05BE78C968B49F965DB1C
SHA-256:	777A81DBCFFD558B3BF992951FC74394A846F3718B6D2AE04FDE9AA5522FB7F1
SHA-512:	EBE7D82306F5C0F227B72A6E08214222495F2F6E54196771BD076F20B0EE8799251CAF3D5166BB2423686D0CCEBC2CD922922AA9E3F5F049B9F6168A1A0D530F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="294873" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416942094502225
Encrypted:	false
SSDEEP:	6144:Pcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNe5+:0i58oSWIZBk2MM6AFBYo
MD5:	6700BD3C845044C8521B7E152E4982AA
SHA1:	3EFC176BD3CF400010457DDF4186132C1BC3DD3A
SHA-256:	1F620B2037B28A616E60B5C3035678FB2035691DEBFCF196FF9C31DB74E817CF
SHA-512:	19A18CC4B9D4FA0D22881E828960865AE5F1F69394FB068F58F8E5315E2F932509062753E14E57CB9C63812A89B69075FD006861F207B10965D682E62A17ECC1
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.iA...................................................................................................................................................................................................................................................................................................................................................W.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.175068416693566
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe
File size:	1'761'280 bytes
MD5:	44ba489fd3a12bd062c96421145d2d2f
SHA1:	867383ba1ed8a9760c4051beb1a694fa662758f9
SHA256:	161a2f35c23c46ab65bdb91ed5cc720919b96d11fc6b9a8d2a9498d2ec35fc84
SHA512:	2150eb86cfc11dab5c52fc16e8c33195b5f65a2ecbf0ae9df921686318e75ca9c8363b98262563284f6d0a1086faa4f0d9a1f959363e6bfd6c3ed4a463133aa0
SSDEEP:	24576:6zCGa8qTBe+fAKzWoITfJPSIOa06rexSSsI8HW5QRuk8rqFnng59GbL6bF5TnC:6zCAq30gKSVqlgskF5T
TLSH:	07855B60B591C517D0271934CD6B8BE9AB37BB412D2C299F39B60F0C5F34A9076A4FCA
File Content Preview:	MZ......................@...............................................!.L.!This file was created by ClamAV for internal use and should not be run...ClamAV - A GPL virus scanner - http://www.clamav.net..$...PE..L...CLAM................. ...Z.......-.....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x562dc0
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x4D414C43 [Thu Jan 27 10:43:15 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00562758h
call 00007F5149B62A79h
mov eax, dword ptr [0056BCACh]
mov eax, dword ptr [eax]
call 00007F51A9E53079h
mov eax, dword ptr [0056BCACh]
mov eax, dword ptr [eax]
mov edx, 00562E20h
call 00007F5191E13079h
mov ecx, dword ptr [0056BCF4h]
mov eax, dword ptr [0056BCACh]
mov eax, dword ptr [eax]
mov edx, dword ptr [0055A060h]
call 00007F51C1E53079h
mov eax, dword ptr [0056BCACh]
mov eax, dword ptr [eax]
call 00007F5241E63079h
call 00007F51ED922A79h
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16e000	0x2cdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18c000	0x21600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x173000	0x1830c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x172000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x162000	0x162000	4ef0c8c8af36ded8052648d67d195a14	False	0.3923601915607345	data	6.547952475772612	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x163000	0x9000	0x9000	24129a0575cb840a1898840b17c7ec96	False	0.5302463107638888	data	6.001812465658848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x16c000	0x2000	0x2000	0829f71740aab1ab98b33eae21dee122	False	0.0037841796875	data	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x16e000	0x3000	0x3000	4072783b8efb99a9e5817067d68f61c6	False	0.0028483072916666665	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x171000	0x1000	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x172000	0x1000	0x1000	2554aeb3fd52d0b55ca3a57aaa0b4dc7	False	0.010009765625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "W"	0.0329817943134386	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x173000	0x19000	0x19000	4c6426ac7ef186464ecbb0d81cbfcb1e	False	0.001181640625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x18c000	0x22000	0x22000	89fd3474450b04598cb6fe346a6529a0	False	0.19614545036764705	data	4.961697361037533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exePID: 1072, Parent PID: 4056

General

Target ID:	0
Start time:	05:30:41
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe"
Imagebase:	0x400000
File size:	1'761'280 bytes
MD5 hash:	44BA489FD3A12BD062C96421145D2D2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6440, Parent PID: 1072

General

Target ID:	4
Start time:	05:30:41
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 232
Imagebase:	0x10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exePID: 1072, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	2
Total number of Limit Nodes:	0

Executed Functions

Function 00562DC0 Relevance: 1.5, APIs: 1, Instructions: 22
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00562DCB

Memory Dump Source

Source File: 00000000.00000002.1652342157.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1652327499.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652431066.0000000000563000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652447019.0000000000564000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.000000000058D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 627df84c8ae16c40804b575d5f8de30af741994304e598c2411e872c2d5920cd
Instruction ID: 67d8f1075689b8b8b5a95a7ec6ebcd6a0e57986d4b324409d392eb5e7c8aefb1
Opcode Fuzzy Hash: 627df84c8ae16c40804b575d5f8de30af741994304e598c2411e872c2d5920cd
Instruction Fuzzy Hash: B4F0A5786206418FE215EB6DDC8080A77E5AF6A3347004761E932CB3F5DF70AD88EB56

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004BC56C Relevance: 9.0, Strings: 7, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Folder\shell\open\ddeexec\application, xrefs: 004BC616
htmlfile\shell\open\ddeexec\topic, xrefs: 004BC5E5
Folder\shell\open\ddeexec, xrefs: 004BC678
Folder\shell\open\ddeexec\topic, xrefs: 004BC647
Directory\shell\find\ddeexec, xrefs: 004BC750
Folder\shell\explore\ddeexec, xrefs: 004BC6E4
htmlfile\shell\open\ddeexec\application, xrefs: 004BC5B4

Memory Dump Source

Source File: 00000000.00000002.1652342157.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1652327499.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652431066.0000000000563000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652447019.0000000000564000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.000000000058D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Directory\shell\find\ddeexec$Folder\shell\explore\ddeexec$Folder\shell\open\ddeexec$Folder\shell\open\ddeexec\application$Folder\shell\open\ddeexec\topic$htmlfile\shell\open\ddeexec\application$htmlfile\shell\open\ddeexec\topic
API String ID: 0-347982240
Opcode ID: 49dd3977387f8d7acb5265712cdf5af88ab0c284336f45fbb0f59ec1704598a1
Instruction ID: 745efa397715ac93b5e1cdc24fbdd51450868626e70dce5921adda9b702fb8dd
Opcode Fuzzy Hash: 49dd3977387f8d7acb5265712cdf5af88ab0c284336f45fbb0f59ec1704598a1
Instruction Fuzzy Hash: 06713234A00109ABDB04DBADCCC099EBBB5EF58370F608775A435E72E4DB31AE429B54

Uniqueness

Uniqueness Score: -1.00%

Function 004B2F40 Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

X, xrefs: 004B30ED
F, xrefs: 004B30D9
X, xrefs: 004B30E3
J, xrefs: 004B2F5E
J, xrefs: 004B30D0

Memory Dump Source

Source File: 00000000.00000002.1652342157.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1652327499.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652431066.0000000000563000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652447019.0000000000564000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.000000000058D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: F$J$J$X$X
API String ID: 0-2166313073
Opcode ID: 3a46c644e3901bba524907955ac2852bf42d61821e84fe8c619e22aa70ae201d
Instruction ID: 35e04a83c4bf40af75759a763d7d1a6dc91120faa47d28ab2d3b1943e14d9bee
Opcode Fuzzy Hash: 3a46c644e3901bba524907955ac2852bf42d61821e84fe8c619e22aa70ae201d
Instruction Fuzzy Hash: FE7160706042809FD718CF29C4946D2BFE1AF5A305F19C0DED4898F367C67ADA45CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004C8E84 Relevance: 5.5, Strings: 4, Instructions: 503COMMON

Download Yara Rule

Strings

|VL, xrefs: 004C8EF8
DTD, xrefs: 004C9302
(QL, xrefs: 004C9194
/, xrefs: 004C90BF

Memory Dump Source

Source File: 00000000.00000002.1652342157.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1652327499.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652431066.0000000000563000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652447019.0000000000564000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.000000000058D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (QL$/$DTD$|VL
API String ID: 0-2422176275
Opcode ID: 84831519593d14fbc7f3a1dbe93fcc1789560eb20fb1807bd4538eab99ef4365
Instruction ID: de9660f0affd8747adf6bd30c55b114dec2cb01f41d96e77023517fc2715ce2a
Opcode Fuzzy Hash: 84831519593d14fbc7f3a1dbe93fcc1789560eb20fb1807bd4538eab99ef4365
Instruction Fuzzy Hash: C1226234E04209AFDB40DFA9D884E9DB7B5EF49320F148799E824A73E1DB34AD46CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0047A1E4 Relevance: .9, Instructions: 905COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652342157.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1652327499.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652431066.0000000000563000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652447019.0000000000564000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.000000000058D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a99302dcf55f28adf6deace501da0444bca81a6d21c8fc9a33bedceaf65fc80
Instruction ID: 76571697bbdc21166d032fb3ad3a987bb277c76fa08eaba157e09e7c1702e225
Opcode Fuzzy Hash: 9a99302dcf55f28adf6deace501da0444bca81a6d21c8fc9a33bedceaf65fc80
Instruction Fuzzy Hash: 0A822834A00204DFCB14CF68C588ADEB7F1EF89320F2586A5E8589B3A5C774EE91DB55

Uniqueness

Uniqueness Score: -1.00%

Function 0047FCE4 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652342157.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1652327499.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652431066.0000000000563000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652447019.0000000000564000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.000000000058D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9067f66f78da171b3c7e34c0e2e211940358d82ab7c6d63458278448396c4fb6
Instruction ID: 01d411a93df61492fde961060128021d818ee92f83fdb2cea533467e6235c839
Opcode Fuzzy Hash: 9067f66f78da171b3c7e34c0e2e211940358d82ab7c6d63458278448396c4fb6
Instruction Fuzzy Hash: 3FD16F75B00209ABD744DFBEDC80A9F77AAAF89630B10CB65B535DB2E0CA74DD418760

Uniqueness

Uniqueness Score: -1.00%

Function 004A7F70 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652342157.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1652327499.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652431066.0000000000563000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652447019.0000000000564000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.000000000058D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1652463246.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413fe3e327f029ca768075a276287aeff6facea65a842bd2c0367a9e8cfa7663
Instruction ID: 20240964bf6d6aa05a09df630e7e0c5c2a62bea86416466872b786670aebdf8b
Opcode Fuzzy Hash: 413fe3e327f029ca768075a276287aeff6facea65a842bd2c0367a9e8cfa7663
Instruction Fuzzy Hash: B1915D34A00218DFDB21CB69C984B9EB7F5EF5A310F5042EAE814A73A0DB359E85CB45

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_9d50f1a2eb86aa236a701d83e0f8c17bb555f3_2ef1b157_e76709af-2bca-4fd8-aeaf-5d9a60530078\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER866C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER86AB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER86EB.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exePID: 1072, Parent PID: 4056

General

Chronological Activities

Analysis Process: WerFault.exePID: 6440, Parent PID: 1072

General

Chronological Activities

Windows Analysis Report
SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.12002.13899.exe

Function 00562DC0 Relevance: 1.5, APIs: 1, Instructions: 22
libraryCOMMON

Function 004BC56C Relevance: 9.0, Strings: 7, Instructions: 201
COMMON