Edit tour

Windows Analysis Report
injectorQWEEX.exe

Overview

General Information

Sample name:	injectorQWEEX.exe (renamed file extension from bin to exe)
Original sample name:	injectorQWEEX.bin
Analysis ID:	1630529
MD5:	d44daf1beea1a9ed0cc2eeacd2bfbd5c
SHA1:	22e54e3272ada9a1546e80e10ff73425da5e1ab5
SHA256:	b2fc6d0c50f49c03a0f7863ca82036d09a74a275080ae5aebe7131582a893612
Infos:

Detection

PureLog Stealer, RedLine, zgRAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Joe Sandbox ML detected suspicious sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64native

injectorQWEEX.exe (PID: 1304 cmdline: "C:\Users\user\Desktop\injectorQWEEX.exe" MD5: D44DAF1BEEA1A9ED0CC2EEACD2BFBD5C)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: RedLine

{"C2 url": "45.15.156.127:23000"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: injectorQWEEX.exe PID: 1304	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.injectorQWEEX.exe.1052998.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.injectorQWEEX.exe.1052998.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.injectorQWEEX.exe.1052998.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.injectorQWEEX.exe.1052998.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x3d3a7:$s1: file:/// 0x3d2df:$s2: {11111-22222-10009-11112} 0x3d337:$s3: {11111-22222-50001-00000} 0x3880c:$s4: get_Module 0x38c76:$s5: Reverse 0x3b642:$s6: BlockCopy 0x39035:$s7: ReadByte 0x3d3b9:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.injectorQWEEX.exe.1240000.2.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.injectorQWEEX.exe.1240000.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.injectorQWEEX.exe.1240000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.injectorQWEEX.exe.1240000.2.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x3d3a7:$s1: file:/// 0x3d2df:$s2: {11111-22222-10009-11112} 0x3d337:$s3: {11111-22222-50001-00000} 0x3880c:$s4: get_Module 0x38c76:$s5: Reverse 0x3b642:$s6: BlockCopy 0x39035:$s7: ReadByte 0x3d3b9:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.injectorQWEEX.exe.1052998.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.injectorQWEEX.exe.1052998.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.injectorQWEEX.exe.1052998.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.injectorQWEEX.exe.1052998.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x3b5a7:$s1: file:/// 0x3b4df:$s2: {11111-22222-10009-11112} 0x3b537:$s3: {11111-22222-50001-00000} 0x36a0c:$s4: get_Module 0x36e76:$s5: Reverse 0x39842:$s6: BlockCopy 0x37235:$s7: ReadByte 0x3b5b9:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 7 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: injectorQWEEX.exe.1304.0.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "45.15.156.127:23000"}

Multi AV Scanner detection for submitted file

Source: injectorQWEEX.exe

Virustotal: Detection: 47%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: injectorQWEEX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: injectorQWEEX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8 source: injectorQWEEX.exe, 00000000.00000003.24411418172.0000000001428000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25526698824.000000000142D000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24412348172.000000000142C000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409019947.0000000001428000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D57000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D57000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb969588382-3778222414-1001_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdbF source: injectorQWEEX.exe, 00000000.00000003.24411418172.0000000001428000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24412348172.000000000142C000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409019947.0000000001428000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb^I source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D57000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D57000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000003.24411418172.0000000001428000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25526698824.000000000142D000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24412348172.000000000142C000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409019947.0000000001428000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: applaunch.pdb source: injectorQWEEX.exe, 00000000.00000002.25545351239.0000000004541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25545351239.000000000459D000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.25450375781.00000000045BE000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24698088273.00000000045BE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D57000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D57000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Code function: 0_2_00D36370 FindFirstFileExW,

0_2_00D36370

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.15.156.127:23000

Source: global traffic

TCP traffic: 192.168.11.20:49751 -> 45.15.156.127:23000

Source: Joe Sandbox View

IP Address: 45.15.156.127 45.15.156.127

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.156.127

Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/exa
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1LR
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1Response
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1ResponsetYHq
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2D
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2LR
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2Response
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2d
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2rm
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3LR
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3Response
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3nm
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, Strings.cs

Large array initialization: Strings: array initializer size 6160

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2C4D0	0_2_00D2C4D0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D28890	0_2_00D28890
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D274B0	0_2_00D274B0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2EC50	0_2_00D2EC50
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D1A840	0_2_00D1A840
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D26030	0_2_00D26030
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2B030	0_2_00D2B030
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D25C20	0_2_00D25C20
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2A1E0	0_2_00D2A1E0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D295E0	0_2_00D295E0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D19DB0	0_2_00D19DB0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D3D151	0_2_00D3D151
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2B6C0	0_2_00D2B6C0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2BA90	0_2_00D2BA90
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D156B0	0_2_00D156B0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D27660	0_2_00D27660
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D1DA10	0_2_00D1DA10
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D253D0	0_2_00D253D0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D26BC0	0_2_00D26BC0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D29B10	0_2_00D29B10
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D24B10	0_2_00D24B10
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D26730	0_2_00D26730
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2E730	0_2_00D2E730
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D28F20	0_2_00D28F20
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D26320	0_2_00D26320
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_03340870	0_2_03340870
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_03340880	0_2_03340880
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_03347668	0_2_03347668
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_0334765A	0_2_0334765A
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_069475B8	0_2_069475B8
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_0694A3F8	0_2_0694A3F8
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_0694A3EA	0_2_0694A3EA
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_069481F8	0_2_069481F8

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Code function: String function: 00D2FDB0 appears 33 times

Source: injectorQWEEX.exe, 00000000.00000002.25545351239.0000000004541000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapplaunch.exeT vs injectorQWEEX.exe
Source: injectorQWEEX.exe, 00000000.00000002.25524783931.00000000010D5000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGristles.exe" vs injectorQWEEX.exe
Source: injectorQWEEX.exe, 00000000.00000002.25545351239.000000000459D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapplaunch.exeT vs injectorQWEEX.exe
Source: injectorQWEEX.exe, 00000000.00000003.25450375781.00000000045BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapplaunch.exeT vs injectorQWEEX.exe
Source: injectorQWEEX.exe, 00000000.00000002.25526194072.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs injectorQWEEX.exe
Source: injectorQWEEX.exe, 00000000.00000002.25525360540.00000000012C6000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGristles.exe" vs injectorQWEEX.exe
Source: injectorQWEEX.exe, 00000000.00000003.24698088273.00000000045BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapplaunch.exeT vs injectorQWEEX.exe

Source: injectorQWEEX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: injectorQWEEX.exe

Static PE information: Section: .reloc IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, --.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, --.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/0@0/1

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03

Source: injectorQWEEX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: injectorQWEEX.exe

Virustotal: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\injectorQWEEX.exe "C:\Users\user\Desktop\injectorQWEEX.exe"
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Section loaded: mswsock.dll	Jump to behavior

Source: injectorQWEEX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: injectorQWEEX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8 source: injectorQWEEX.exe, 00000000.00000003.24411418172.0000000001428000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25526698824.000000000142D000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24412348172.000000000142C000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409019947.0000000001428000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D57000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D57000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb969588382-3778222414-1001_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32 source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdbF source: injectorQWEEX.exe, 00000000.00000003.24411418172.0000000001428000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24412348172.000000000142C000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409019947.0000000001428000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb^I source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D57000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D57000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D18000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000003.24411418172.0000000001428000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25526698824.000000000142D000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24412348172.000000000142C000.00000004.00000020.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409019947.0000000001428000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: applaunch.pdb source: injectorQWEEX.exe, 00000000.00000002.25545351239.0000000004541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25545351239.000000000459D000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.25450375781.00000000045BE000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24698088273.00000000045BE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D57000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D57000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, --.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: injectorQWEEX.exe

Static PE information: real checksum: 0xe574a should be: 0xf2fa3

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D3D861 push ecx; ret	0_2_00D3D874
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_0334F4F0 push esp; retf	0_2_0334F4F1
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_0694DEC8 push es; retf	0_2_0694DF7C
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_06946A60 push es; retn 0004h	0_2_06946FB0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_0694F280 push es; ret	0_2_0694F290
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_06946FA0 push es; retn 0004h	0_2_06946FB0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_06941C10 push es; ret	0_2_06941C20
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_06941BB0 push es; ret	0_2_06941BE0
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_06941BF0 push es; ret	0_2_06941C00
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_0694E88A push eax; ret	0_2_0694E891

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Memory allocated: 3540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Memory allocated: 3480000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Window / User API: threadDelayed 9986

Jump to behavior

Source: C:\Users\user\Desktop\injectorQWEEX.exe

API coverage: 7.5 %

Source: C:\Users\user\Desktop\injectorQWEEX.exe TID: 1080

Thread sleep count: 9986 > 30

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Code function: 0_2_00D36370 FindFirstFileExW,

0_2_00D36370

Source: injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: injectorQWEEX.exe, 00000000.00000002.25546885364.0000000005D57000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000003.24409635498.0000000005D57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlliis

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Code function: 0_2_00D33BE6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D33BE6

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Code function: 0_2_00D385F3 GetProcessHeap,

0_2_00D385F3

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2FCEC SetUnhandledExceptionFilter,	0_2_00D2FCEC
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2F6B2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D2F6B2
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D33BE6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D33BE6
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Code function: 0_2_00D2FB90 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D2FB90

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Code function: 0_2_00D2FDF5 cpuid

0_2_00D2FDF5

Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\injectorQWEEX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Code function: 0_2_00D2FA77 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00D2FA77

Source: C:\Users\user\Desktop\injectorQWEEX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: injectorQWEEX.exe PID: 1304, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: injectorQWEEX.exe PID: 1304, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1240000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.injectorQWEEX.exe.1052998.1.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
injectorQWEEX.exe	48%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
45.15.156.127:23000	0%	Avira URL Cloud	safe

Domains and IPs

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.15.156.127:23000	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://tempuri.org/example/Field2d	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2rm	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3nm	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1LR	injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1ResponsetYHq	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3LR	injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2LR	injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2D	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/exa	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discord.com/api/v9/users/	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1Response	injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2Response	injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3Response	injectorQWEEX.exe, 00000000.00000002.25529253904.000000000391B000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.00000000037A2000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003B1E000.00000004.00000800.00020000.00000000.sdmp, injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003A92000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/actor/next	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	injectorQWEEX.exe, 00000000.00000002.25529253904.0000000003541000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.15.156.127	unknown	Russian Federation		39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630529
Start date and time:	2025-03-06 01:31:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	injectorQWEEX.exe (renamed file extension from bin to exe)
Original Sample Name:	injectorQWEEX.bin
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 90 Number of non-executed functions: 47

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

GetCurrentProcess, GetModuleHandleA, K32GetModuleInformation, CreateFileA, CreateFileMappingA, MapViewOfFile, VirtualProtect, CloseHandle, FreeLibrary, VirtualAlloc, VirtualAllocEx, LoadLibraryA, GetProcAddress, lstrlenW, CreateThread, Sleep, WaitForSingleObject, FreeConsole, GetCurrentThreadId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, WriteConsoleW, RaiseException, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, EncodePointer, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, CompareStringW, LCMapStringW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, CreateFileW, DecodePointer

ntdll.dll

AdjustElement, StreamlineOperation, ReconstructInstrument, ReconstructComponent, ImproveOperation, EnhanceResource, InnovatePart, OverhaulPart, InnovateOperation, ModifyConfiguration, ImproveResource, OverhaulPart, ReconstructLayer, StreamlineResource, ImproveResource, RefinePart, ReconfigureEndpoint, ImproveComponent, ReconfigureUnit, BuildPart, ReconstructUnit, InnovateResource, AdjustOperation, DeactivateLayer, PersonalizeFramework, DeactivateComponent, ImproveEndpoint, ModernizeEndpoint, ImproveOperation, InnovateConfiguration, StreamlineOperation, ModifyProtocol, StreamlineElement, OverhaulInstrument, ModifyConfiguration, ReconstructObject, AdjustComponent, RefinePart, ImproveConfiguration, ImproveOperation, RefinePart, ReconstructPart, EnhanceResource, ModifyDesire, UpdateLayer, StreamlineCapability, ReconfigureLayer, ImproveProtocol, BuildElement, ReconstructObject, ModifyConfiguration, ReconstructPart, ModifyOperation, AdjustElement, ModernizePart, StreamlineArtifact

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 6, 2025 01:33:46.260256052 CET	49751	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:46.568438053 CET	23000	49751	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:47.075937986 CET	49751	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:47.383599997 CET	23000	49751	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:47.888261080 CET	49751	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:48.199728012 CET	23000	49751	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:48.700661898 CET	49751	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:49.011476994 CET	23000	49751	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:49.513227940 CET	49751	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:49.821636915 CET	23000	49751	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:49.941736937 CET	49752	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:50.250056028 CET	23000	49752	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:50.762712002 CET	49752	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:51.070544004 CET	23000	49752	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:51.575184107 CET	49752	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:51.883517981 CET	23000	49752	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:52.387331963 CET	49752	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:52.702047110 CET	23000	49752	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:53.215501070 CET	49752	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:53.523829937 CET	23000	49752	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:53.924940109 CET	49753	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:54.233541965 CET	23000	49753	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:54.746382952 CET	49753	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:55.054595947 CET	23000	49753	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:55.558792114 CET	49753	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:55.867587090 CET	23000	49753	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:56.370901108 CET	49753	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:56.679347038 CET	23000	49753	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:57.183269024 CET	49753	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:57.491744041 CET	23000	49753	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:57.501349926 CET	49754	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:57.810534954 CET	23000	49754	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:58.323811054 CET	49754	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:58.632894039 CET	23000	49754	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:59.135880947 CET	49754	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:33:59.444493055 CET	23000	49754	45.15.156.127	192.168.11.20
Mar 6, 2025 01:33:59.948056936 CET	49754	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:00.256937027 CET	23000	49754	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:00.760404110 CET	49754	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:01.069154024 CET	23000	49754	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:01.076314926 CET	49755	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:01.384622097 CET	23000	49755	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:01.885286093 CET	49755	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:02.193361998 CET	23000	49755	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:02.697544098 CET	49755	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:03.006416082 CET	23000	49755	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:03.509993076 CET	49755	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:03.818763018 CET	23000	49755	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:04.322390079 CET	49755	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:04.631614923 CET	23000	49755	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:04.640007019 CET	49756	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:04.948561907 CET	23000	49756	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:05.462654114 CET	49756	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:05.771481037 CET	23000	49756	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:06.274727106 CET	49756	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:06.582602978 CET	23000	49756	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:07.087049007 CET	49756	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:07.395421982 CET	23000	49756	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:07.899501085 CET	49756	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:08.207469940 CET	23000	49756	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:08.214624882 CET	49757	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:08.523180962 CET	23000	49757	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:09.024108887 CET	49757	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:09.332771063 CET	23000	49757	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:09.836525917 CET	49757	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:10.145358086 CET	23000	49757	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:10.648780107 CET	49757	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:10.957269907 CET	23000	49757	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:11.461056948 CET	49757	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:11.769469976 CET	23000	49757	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:11.776958942 CET	49758	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:12.085585117 CET	23000	49758	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:12.585844040 CET	49758	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:12.894085884 CET	23000	49758	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:13.398382902 CET	49758	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:13.706990004 CET	23000	49758	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:14.210572004 CET	49758	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:14.521014929 CET	23000	49758	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:15.022748947 CET	49758	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:15.331090927 CET	23000	49758	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:15.338243961 CET	49759	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:15.647948027 CET	23000	49759	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:16.163234949 CET	49759	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:16.471645117 CET	23000	49759	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:16.975425005 CET	49759	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:17.283730030 CET	23000	49759	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:17.787990093 CET	49759	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:18.096535921 CET	23000	49759	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:18.600076914 CET	49759	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:18.908483982 CET	23000	49759	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:18.918813944 CET	49760	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:19.230405092 CET	23000	49760	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:19.740609884 CET	49760	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:20.049590111 CET	23000	49760	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:20.552793026 CET	49760	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:20.861399889 CET	23000	49760	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:21.365062952 CET	49760	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:21.674352884 CET	23000	49760	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:22.177522898 CET	49760	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:22.486278057 CET	23000	49760	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:22.560453892 CET	49762	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:22.868495941 CET	23000	49762	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:23.380611897 CET	49762	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:23.689790964 CET	23000	49762	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:24.192766905 CET	49762	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:24.504163027 CET	23000	49762	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:25.004925013 CET	49762	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:25.313411951 CET	23000	49762	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:25.817457914 CET	49762	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:26.126030922 CET	23000	49762	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:26.133785963 CET	49763	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:26.442600965 CET	23000	49763	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:26.957633018 CET	49763	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:27.266216993 CET	23000	49763	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:27.769889116 CET	49763	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:28.080929041 CET	23000	49763	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:28.582110882 CET	49763	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:28.890399933 CET	23000	49763	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:29.394423962 CET	49763	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:29.703129053 CET	23000	49763	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:29.710443020 CET	49764	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:30.018903017 CET	23000	49764	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:30.519543886 CET	49764	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:30.829497099 CET	23000	49764	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:31.331607103 CET	49764	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:31.640170097 CET	23000	49764	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:32.143891096 CET	49764	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:32.453941107 CET	23000	49764	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:32.956324100 CET	49764	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:33.265652895 CET	23000	49764	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:33.273041964 CET	49765	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:33.581975937 CET	23000	49765	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:34.096537113 CET	49765	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:34.405142069 CET	23000	49765	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:34.909143925 CET	49765	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:35.217994928 CET	23000	49765	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:35.721128941 CET	49765	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:36.029512882 CET	23000	49765	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:36.533641100 CET	49765	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:36.842446089 CET	23000	49765	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:36.851358891 CET	49766	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:37.159831047 CET	23000	49766	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:37.673986912 CET	49766	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:37.982647896 CET	23000	49766	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:38.486550093 CET	49766	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:38.794600964 CET	23000	49766	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:39.298604012 CET	49766	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:39.607988119 CET	23000	49766	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:40.110812902 CET	49766	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:40.420121908 CET	23000	49766	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:40.427316904 CET	49767	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:40.735925913 CET	23000	49767	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:41.251363993 CET	49767	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:41.559858084 CET	23000	49767	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:42.063805103 CET	49767	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:42.371995926 CET	23000	49767	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:42.875745058 CET	49767	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:43.184511900 CET	23000	49767	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:43.688237906 CET	49767	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:43.997178078 CET	23000	49767	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:44.004745960 CET	49768	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:44.313281059 CET	23000	49768	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:44.828603029 CET	49768	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:45.136734009 CET	23000	49768	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:45.640805960 CET	49768	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:45.949681997 CET	23000	49768	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:46.453304052 CET	49768	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:46.761913061 CET	23000	49768	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:47.265655041 CET	49768	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:47.575424910 CET	23000	49768	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:47.583117962 CET	49769	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:47.892446041 CET	23000	49769	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:48.405926943 CET	49769	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:48.714700937 CET	23000	49769	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:49.218274117 CET	49769	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:49.527512074 CET	23000	49769	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:50.030436993 CET	49769	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:50.340220928 CET	23000	49769	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:50.842875957 CET	49769	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:51.151645899 CET	23000	49769	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:51.219878912 CET	49770	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:51.528294086 CET	23000	49770	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:52.030190945 CET	49770	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:52.338699102 CET	23000	49770	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:52.842597008 CET	49770	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:53.151701927 CET	23000	49770	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:53.654572010 CET	49770	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:53.962963104 CET	23000	49770	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:54.467040062 CET	49770	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:54.776451111 CET	23000	49770	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:54.783474922 CET	49771	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:55.091953039 CET	23000	49771	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:55.607589960 CET	49771	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:55.916030884 CET	23000	49771	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:56.419600964 CET	49771	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:56.734586000 CET	23000	49771	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:57.247637987 CET	49771	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:57.555887938 CET	23000	49771	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:58.060122967 CET	49771	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:58.368673086 CET	23000	49771	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:58.378025055 CET	49772	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:58.686469078 CET	23000	49772	45.15.156.127	192.168.11.20
Mar 6, 2025 01:34:59.200356007 CET	49772	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:34:59.513046026 CET	23000	49772	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:00.028145075 CET	49772	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:00.337341070 CET	23000	49772	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:00.840883017 CET	49772	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:01.149610043 CET	23000	49772	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:01.652838945 CET	49772	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:01.961571932 CET	23000	49772	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:01.969779015 CET	49773	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:02.278867006 CET	23000	49773	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:02.793298960 CET	49773	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:03.102046967 CET	23000	49773	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:03.605487108 CET	49773	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:03.913990021 CET	23000	49773	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:04.417901993 CET	49773	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:04.726490021 CET	23000	49773	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:05.230334997 CET	49773	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:05.539526939 CET	23000	49773	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:05.547405005 CET	49774	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:05.855709076 CET	23000	49774	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:06.370517969 CET	49774	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:06.678921938 CET	23000	49774	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:07.183111906 CET	49774	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:07.490928888 CET	23000	49774	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:07.995122910 CET	49774	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:08.303610086 CET	23000	49774	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:08.807487965 CET	49774	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:09.115925074 CET	23000	49774	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:09.122904062 CET	49775	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:09.427083015 CET	23000	49775	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:09.932416916 CET	49775	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:10.239869118 CET	23000	49775	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:10.744447947 CET	49775	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:11.048676014 CET	23000	49775	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:11.557010889 CET	49775	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:11.861144066 CET	23000	49775	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:12.369311094 CET	49775	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:12.674632072 CET	23000	49775	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:12.682158947 CET	49776	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:12.991143942 CET	23000	49776	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:13.494066954 CET	49776	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:13.805493116 CET	23000	49776	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:14.306312084 CET	49776	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:14.614883900 CET	23000	49776	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:15.118457079 CET	49776	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:15.426928997 CET	23000	49776	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:15.931277037 CET	49776	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:16.240864038 CET	23000	49776	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:16.249454021 CET	49777	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:16.558924913 CET	23000	49777	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:17.071135998 CET	49777	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:17.381014109 CET	23000	49777	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:17.883709908 CET	49777	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:18.192285061 CET	23000	49777	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:18.695780039 CET	49777	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:19.004160881 CET	23000	49777	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:19.508104086 CET	49777	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:19.816724062 CET	23000	49777	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:19.825490952 CET	49778	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:20.133706093 CET	23000	49778	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:20.648551941 CET	49778	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:20.958523035 CET	23000	49778	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:21.460784912 CET	49778	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:21.768950939 CET	23000	49778	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:22.273370028 CET	49778	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:22.581733942 CET	23000	49778	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:23.085429907 CET	49778	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:23.394407988 CET	23000	49778	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:23.402196884 CET	49779	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:23.710877895 CET	23000	49779	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:24.225843906 CET	49779	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:24.534132004 CET	23000	49779	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:25.038089991 CET	49779	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:25.347310066 CET	23000	49779	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:25.850707054 CET	49779	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:26.159225941 CET	23000	49779	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:26.662862062 CET	49779	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:26.971196890 CET	23000	49779	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:26.981538057 CET	49780	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:27.290307045 CET	23000	49780	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:27.803096056 CET	49780	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:28.111787081 CET	23000	49780	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:28.615571022 CET	49780	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:28.924285889 CET	23000	49780	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:29.427684069 CET	49780	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:29.736465931 CET	23000	49780	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:30.240358114 CET	49780	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:30.549597979 CET	23000	49780	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:30.556804895 CET	49781	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:30.867064953 CET	23000	49781	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:31.380728006 CET	49781	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:31.689551115 CET	23000	49781	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:32.192981005 CET	49781	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:32.501247883 CET	23000	49781	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:33.005029917 CET	49781	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:33.313497066 CET	23000	49781	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:33.817389965 CET	49781	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:34.126672983 CET	23000	49781	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:34.133903027 CET	49782	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:34.442348003 CET	23000	49782	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:34.957901001 CET	49782	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:35.275947094 CET	23000	49782	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:35.785742044 CET	49782	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:36.094522953 CET	23000	49782	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:36.598464012 CET	49782	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:36.907161951 CET	23000	49782	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:37.410634041 CET	49782	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:37.719089031 CET	23000	49782	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:37.801599979 CET	49783	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:38.110846996 CET	23000	49783	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:38.613250017 CET	49783	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:38.922041893 CET	23000	49783	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:39.425482988 CET	49783	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:39.734322071 CET	23000	49783	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:40.237984896 CET	49783	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:40.548976898 CET	23000	49783	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:41.057332039 CET	49783	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:41.365833998 CET	23000	49783	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:41.374358892 CET	49784	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:41.682560921 CET	23000	49784	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:42.190685034 CET	49784	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:42.498558998 CET	23000	49784	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:43.003106117 CET	49784	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:43.311523914 CET	23000	49784	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:43.815067053 CET	49784	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:44.123574018 CET	23000	49784	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:44.627376080 CET	49784	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:44.936410904 CET	23000	49784	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:44.943337917 CET	49785	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:45.251214981 CET	23000	49785	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:45.752166986 CET	49785	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:46.060405016 CET	23000	49785	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:46.564440012 CET	49785	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:46.872437954 CET	23000	49785	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:47.376776934 CET	49785	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:47.685388088 CET	23000	49785	45.15.156.127	192.168.11.20
Mar 6, 2025 01:35:48.189074039 CET	49785	23000	192.168.11.20	45.15.156.127
Mar 6, 2025 01:35:48.496948957 CET	23000	49785	45.15.156.127	192.168.11.20

Target ID:	0
Start time:	19:33:38
Start date:	05/03/2025
Path:	C:\Users\user\Desktop\injectorQWEEX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injectorQWEEX.exe"
Imagebase:	0xd10000
File size:	934'664 bytes
MD5 hash:	D44DAF1BEEA1A9ED0CC2EEACD2BFBD5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.25525253706.0000000001242000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.25524783931.0000000001051000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	19:33:38
Start date:	05/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff60fc60000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	78.25.186.83
	splmpsl.elf	Get hash	malicious	Unknown	Browse	78.25.174.64
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	78.25.186.82
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	78.25.187.199
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	217.196.110.143
	LMm6yxQtcf.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	5.42.92.0
	stage-0.bin.exe	Get hash	malicious	GCleaner	Browse	5.42.65.115
	yakuza.ppc.elf	Get hash	malicious	Unknown	Browse	5.42.81.47
	1730537044dd01929d6467da9e0bc05cd98b8bc5df2688589dd2eaebbc46df2ed3bf068fc2733.dat-decoded.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.15.158.112
	QmFIR949GC.exe	Get hash	malicious	RedLine	Browse	5.42.92.74

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	5.760055303303282
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	injectorQWEEX.exe
File size:	934'664 bytes
MD5:	d44daf1beea1a9ed0cc2eeacd2bfbd5c
SHA1:	22e54e3272ada9a1546e80e10ff73425da5e1ab5
SHA256:	b2fc6d0c50f49c03a0f7863ca82036d09a74a275080ae5aebe7131582a893612
SHA512:	b54f8231e974942dded54c3e79c9799b9b2cc519bc799f60f16173e6af8cb8443326b8efb35c5cf0a71459c3b2f2e0a8954d543e63b95a744824d6a4781607d9
SSDEEP:	6144:zHRz7kru9osRQqaO16636YZE9sOjftfzgvbLn03pRrx5t6Fx9r+BWH:zHRkruzaqbF36Y+X7gvH0NX6X9FH
TLSH:	D615E72A59A18781D7F2DEF2FF02D2A2CC600E55092978C2107EAD113FBD7C59662E1F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........,l."..}k!Fl..UX._.].W.?P...!._..1-.Gg.....!....B<.....1.........H..r>....x..C..V<...7..>.....m[..vJc........PE..L....R.f...

Entrypoint:	0x41f6a8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x661552DF [Tue Apr 9 14:38:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	512b765c31a25017956fa9f4e97cb280

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe69c0	0x490	.reloc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe4000	0x1bb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe0970	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe08b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e000	0x144	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2cc33	0x2ce00	b4b2b081585a241bb2d7651dc086f338	False	0.4371518105849582	data	6.630422795643705	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0xb3d16	0xb3e00	a7cf734e68283842a03da3401141de32	False	0.20539029925295343	data	5.067017537648892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe2000	0x1634	0xa00	6786cc10c58411a044b5ef5f478aa4eb	False	0.17734375	data	2.3900382569267067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xe4000	0x1bb0	0x1c00	47ea251e016a565ea04ca6795fd0e530	False	0.7868303571428571	data	6.633302097796085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.reloc	0xe6000	0x1000	0xd08	99697656d12293398a5cea0a221f3f25	False	0.3869904076738609	data	4.674874952161441	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.15.156.127	build.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	doingCTIrocks_crypted.exe	Get hash	malicious	RedLine	Browse
	GbZkRO8wav.exe	Get hash	malicious	RedLine	Browse
	lnker.lnk	Get hash	malicious	RedLine	Browse
	driver.exe	Get hash	malicious	RedLine	Browse
	Eclipse.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, RHADAMANTHYS, RedLine, XWorm, zgRAT	Browse
	7bXVSwc9dp.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	SecuriteInfo.com.Trojan.Agent.446.6903.exe	Get hash	malicious	RedLine	Browse
	axfdj9gfw.exe	Get hash	malicious	RedLine	Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report injectorQWEEX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
injectorQWEEX.exe