Edit tour

Windows Analysis Report
gfehgfwveg.exe

Overview

General Information

Sample name:	gfehgfwveg.exe
Analysis ID:	1580519
MD5:	43ec2649e1b173b6e8b3800e18cceeb4
SHA1:	e864b2d11a7c9c7497b22af930b31db1e2061244
SHA256:	4e906e880e35e4bc0de7e9375fc0feb5757374ca0bb628dff6366174536d6183
Tags:	exeuser-SquiblydooBlog
Infos:

Detection

DanaBot

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DanaBot stealer dll

AI detected suspicious sample

Machine Learning detection for sample

May use the Tor software to hide its network traffic

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential time zone aware malware

Program does not show much activity (idle)

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

gfehgfwveg.exe (PID: 3948 cmdline: "C:\Users\user\Desktop\gfehgfwveg.exe" MD5: 43EC2649E1B173B6E8B3800E18CCEEB4)

cmd.exe (PID: 5908 cmdline: cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6520 cmdline: wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: gfehgfwveg.exe PID: 3948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gfehgfwveg.exe PID: 3948	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security

Suricata Signatures

ET MALWARE Danabot Key Exchange Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T20:58:13.887150+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49830	34.34.145.103	443	TCP
2024-12-24T20:58:14.953488+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49831	34.169.99.17	443	TCP
2024-12-24T20:58:16.044840+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49835	34.83.67.185	443	TCP
2024-12-24T20:58:17.119157+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49838	35.195.45.98	443	TCP
2024-12-24T20:59:18.664291+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49981	34.34.145.103	443	TCP
2024-12-24T20:59:20.009982+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49985	34.169.99.17	443	TCP
2024-12-24T20:59:21.083789+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49988	34.83.67.185	443	TCP
2024-12-24T20:59:22.135469+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	49991	35.195.45.98	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gfehgfwveg.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: gfehgfwveg.exe

ReversingLabs: Detection: 55%

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Machine Learning detection for sample

Source: gfehgfwveg.exe

Joe Sandbox ML: detected

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302E190 FindFirstFileW,FindClose,		0_2_0302E190
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302DBC4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,		0_2_0302DBC4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49830 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49831 -> 34.169.99.17:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49838 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49835 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49981 -> 34.34.145.103:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49988 -> 34.83.67.185:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49991 -> 35.195.45.98:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:49985 -> 34.169.99.17:443

Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS

Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.169.99.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 34.83.67.185
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.195.45.98
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103
Source: unknown	TCP traffic detected without corresponding DNS query: 34.34.145.103

Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: gfehgfwveg.exe, 00000000.00000002.3889930307.000000006E66F000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063469000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2080229872.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2075649868.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: gfehgfwveg.exe, 00000000.00000003.2074901686.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: gfehgfwveg.exe, 00000000.00000003.2074901686.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E525C LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

0_2_034E525C

Source: gfehgfwveg.exe

Static PE information: Number of sections : 11 > 10

Source: gfehgfwveg.exe, 00000000.00000002.3889930307.000000006E66F000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000002.3888275981.0000000063469000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000003.2080229872.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000002.3881473973.00000000025D8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000003.2075649868.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs gfehgfwveg.exe
Source: gfehgfwveg.exe, 00000000.00000002.3886606090.0000000003824000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs gfehgfwveg.exe

Source: gfehgfwveg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal88.troj.evad.winEXE@6/0@0/4

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2876:120:WilError_03

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: gfehgfwveg.exe, 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: gfehgfwveg.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\gfehgfwveg.exe "C:\Users\user\Desktop\gfehgfwveg.exe"
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: gfehgfwveg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gfehgfwveg.exe

Static file information: File size 4276224 > 1048576

Source: gfehgfwveg.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3ec600

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E525C LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

0_2_034E525C

Source: gfehgfwveg.exe

Static PE information: section name: .didata

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2071863727.000000007E870000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Window / User API: threadDelayed 9217			Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Window / User API: threadDelayed 783			Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302E190 FindFirstFileW,FindClose,		0_2_0302E190
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: 0_2_0302DBC4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,		0_2_0302DBC4

Source: gfehgfwveg.exe, 00000000.00000003.2082354644.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: gfehgfwveg.exe, 00000000.00000002.3880702296.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\gfehgfwveg.exe

API call chain: ExitProcess graph end node

graph_0-2563

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E525C LoadLibraryA,GetProcAddress,NtQueryVirtualMemory,NtQueryVirtualMemory,

0_2_034E525C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior

Source: gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2071863727.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: gfehgfwveg.exe, 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, gfehgfwveg.exe, 00000000.00000003.2071863727.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,		0_2_0302E2C8
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		0_2_0302D768

Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\gfehgfwveg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Code function: 0_2_034E583C GetVersionExW,GetVersionExW,LoadLibraryW,

0_2_034E583C

Source: C:\Users\user\Desktop\gfehgfwveg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Remote Access Functionality

Yara detected DanaBot stealer dll

Source: Yara match	File source: 00000000.00000003.2072119961.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3883206719.0000000003039000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gfehgfwveg.exe PID: 3948, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	153 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
gfehgfwveg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gfehgfwveg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
gfehgfwveg.exe