Windows Analysis Report
ngbtiladkrthgad.exe

Overview

General Information

Sample name: ngbtiladkrthgad.exe
Analysis ID: 1637340
MD5: 20beeeadd1cfac0bb5bda17172f1359f
SHA1: fa2ca39b5e4f273d6017cb731086ce0e81af221c
SHA256: c008a013fe6de93e4e83f0ce98098130fc16cecbf15c5e15438a8ccc47ceec69
Tags: exeuser-TornadoAV_dev
Infos:

Detection

Vidar
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Vidar stealer
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Searches for specific processes (likely to inject)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found decision node followed by non-executed suspicious APIs
Found evasive API chain (date check)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Yara detected Credential Stealer
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: ngbtiladkrthgad.exe Avira: detected
Found malware configuration
Source: ngbtiladkrthgad.exe Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199832267488", "Botnet": "dqu220"}
Multi AV Scanner detection for submitted file
Source: ngbtiladkrthgad.exe Virustotal: Detection: 75% Perma Link
Source: ngbtiladkrthgad.exe ReversingLabs: Detection: 71%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00406A10 StrStrA,lstrlenA,LocalAlloc,CryptUnprotectData,LocalAlloc,LocalFree,lstrlenA, 0_2_00406A10
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00410830 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,GetLastError,GetProcessHeap,HeapFree, 0_2_00410830
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040A150 BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptCloseAlgorithmProvider, 0_2_0040A150
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00406CF0 LocalAlloc,BCryptDecrypt, 0_2_00406CF0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00406940 BCryptCloseAlgorithmProvider,BCryptDestroyKey, 0_2_00406940
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040A560 StrCmpCA,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptDestroyKey, 0_2_0040A560
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00406980 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,BCryptCloseAlgorithmProvider,BCryptDestroyKey, 0_2_00406980
Uses 32bit PE files
Source: ngbtiladkrthgad.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00414E70 wsprintfA,FindFirstFileA,DeleteFileA,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose, 0_2_00414E70
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00407210 ExpandEnvironmentStringsA,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,CopyFileA,DeleteFileA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose, 0_2_00407210
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040B6B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindClose, 0_2_0040B6B0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00415EB0 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindClose, 0_2_00415EB0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00408360 FindFirstFileA,CopyFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindClose, 0_2_00408360
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00413FD0 wsprintfA,FindFirstFileA,FindNextFileA,strlen,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose, 0_2_00413FD0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004013F0 FindFirstFileA,FindClose,FindNextFileA,strlen,FindFirstFileA,DeleteFileA,FindNextFileA,CopyFileA,CopyFileA,DeleteFileA,FindClose, 0_2_004013F0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00413580 wsprintfA,FindFirstFileA,memset,memset,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindClose, 0_2_00413580
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004097B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA, 0_2_004097B0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040ACD0 wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,lstrlenA,DeleteFileA,CopyFileA,FindClose, 0_2_0040ACD0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00408C90 lstrcpyA,lstrcatA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose,FindClose,DeleteFileA,_invalid_parameter_noinfo_noreturn, 0_2_00408C90
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00414950 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,strlen,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 0_2_00414950
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00409560 ??2@YAPAXI@Z,??2@YAPAXI@Z,_invalid_parameter_noinfo_noreturn,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA, 0_2_00409560
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00413AF0 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 0_2_00413AF0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: chrome.exe Memory has grown: Private usage: 0MB later: 39MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.4:49728 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49732 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.4:49723 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49733 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49734 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49734 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49763 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49735 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49735 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 78.47.63.132:443 -> 192.168.2.4:49729
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49765 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49765 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 78.47.63.132:443 -> 192.168.2.4:49728
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49766 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49766 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49736 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49736 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49764 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49764 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49767 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49767 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49768 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49768 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49769 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.4:49769 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49760 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49772 -> 78.47.63.132:443
Source: Network traffic Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.4:49774 -> 78.47.63.132:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199832267488
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.4:49737 -> 1.1.1.1:53
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /g_etcontent HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View IP Address: 149.154.167.99 149.154.167.99
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.96.32
Source: unknown TCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown TCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknown TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown TCP traffic detected without corresponding DNS query: 2.16.100.168
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00403850 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle, 0_2_00403850
Source: global traffic HTTP traffic detected: GET /g_etcontent HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0Host: s.p.formaxprime.co.ukConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJahywEInP7MAQiFoM0BCMnRzgEIvtXOAQiB1s4BCMjczgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJahywEInP7MAQiFoM0BCMnRzgEIvtXOAQiB1s4BCMjczgEIiuDOAQiu5M4BCIvlzgE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: t.me
Source: global traffic DNS traffic detected: DNS query: s.p.formaxprime.co.uk
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: apis.google.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----jwl6xbi589zcbasrq9hlUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0Host: s.p.formaxprime.co.ukContent-Length: 255Connection: Keep-AliveCache-Control: no-cache
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.c.lencr.org/101.crl0
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.i.lencr.org/0
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://e5.o.lencr.org0
Source: chromecache_69.9.dr String found in binary or memory: http://www.broofa.com
Source: ngbtiladkrthgad.exe, 00000000.00000003.1194026711.000000000066C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.cd
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825197872.000000000364C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825197872.000000000364C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: jmym7q.0.dr String found in binary or memory: https://ac.ecosia.org?q=
Source: chromecache_69.9.dr String found in binary or memory: https://apis.google.com
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1346023423.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, gdtrim.0.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1346023423.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, gdtrim.0.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: jmym7q.0.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ngbtiladkrthgad.exe, 00000000.00000002.1824410005.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, jmym7q.0.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ngbtiladkrthgad.exe, 00000000.00000002.1824410005.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, jmym7q.0.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1346023423.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, gdtrim.0.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1346023423.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, gdtrim.0.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: jmym7q.0.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ngbtiladkrthgad.exe, 00000000.00000002.1824410005.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, jmym7q.0.dr String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: jmym7q.0.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_69.9.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_69.9.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_69.9.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_69.9.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: jmym7q.0.dr String found in binary or memory: https://gemini.google.com/app?q=
Source: gdtrim.0.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_69.9.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: ngbtiladkrthgad.exe, 00000000.00000003.1224317282.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1321478371.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1273724875.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1193910704.00000000006AF000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.p.formaxprime.co.uk
Source: ngbtiladkrthgad.exe, 00000000.00000003.1273724875.000000000066C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.p.formaxprime.co.uk/
Source: ngbtiladkrthgad.exe, 00000000.00000003.1248848959.0000000000674000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1297921627.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1248778986.0000000000673000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1321478371.000000000066C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.p.formaxprime.co.uk/3
Source: ngbtiladkrthgad.exe, 00000000.00000003.1346023423.00000000006BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.p.formaxprime.co.uk/4p
Source: ngbtiladkrthgad.exe, 00000000.00000003.1274025459.0000000000673000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1224357665.0000000000672000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1248848959.0000000000674000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1297921627.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1248778986.0000000000673000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1224317282.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1321478371.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1273724875.000000000066C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.p.formaxprime.co.uk/e
Source: ngbtiladkrthgad.exe, 00000000.00000003.1224357665.0000000000672000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1248848959.0000000000674000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1248778986.0000000000673000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1224317282.000000000066C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.p.formaxprime.co.uk/tm
Source: ngbtiladkrthgad.exe, 00000000.00000003.1224357665.0000000000672000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1224317282.000000000066C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.p.formaxprime.co.uk3
Source: ngbtiladkrthgad.exe String found in binary or memory: https://steamcommunity.com/profiles/76561199832267488
Source: ngbtiladkrthgad.exe String found in binary or memory: https://steamcommunity.com/profiles/76561199832267488dqu220Mozilla/5.0
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825944490.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825944490.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.00000000005FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/
Source: ngbtiladkrthgad.exe String found in binary or memory: https://t.me/g_etcontent
Source: ngbtiladkrthgad.exe String found in binary or memory: https://t.me/g_etcontentdqu220Mozilla/5.0
Source: ngbtiladkrthgad.exe, 00000000.00000003.1194026711.000000000066C000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000002.1823139867.0000000000640000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1196269467.00000000006AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web.telegram.org
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1346023423.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, gdtrim.0.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: ngbtiladkrthgad.exe, 00000000.00000002.1824410005.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, jmym7q.0.dr String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000003.1346023423.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, gdtrim.0.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: ngbtiladkrthgad.exe, 00000000.00000002.1824410005.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, jmym7q.0.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: chromecache_69.9.dr String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_69.9.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_69.9.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825944490.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825944490.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825944490.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825944490.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825944490.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.4:49776 version: TLS 1.2
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00410A90 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,malloc,StrCmpCW,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 0_2_00410A90
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00406480 memcpy,OpenDesktopA,CreateDesktopA,lstrcpyA,CreateProcessA,Sleep,CloseDesktop, 0_2_00406480

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: ngbtiladkrthgad.exe, type: SAMPLE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 0.0.ngbtiladkrthgad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 0.2.ngbtiladkrthgad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Detected potential crypto function
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00404A20 0_2_00404A20
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00418630 0_2_00418630
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0041B770 0_2_0041B770
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0041B300 0_2_0041B300
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0041C100 0_2_0041C100
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004193D0 0_2_004193D0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0041A7D0 0_2_0041A7D0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: String function: 00410D00 appears 42 times
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: String function: 0040F5B0 appears 135 times
Sample file is different than original file name gathered from version info
Source: ngbtiladkrthgad.exe, 00000000.00000002.1825197872.000000000386E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs ngbtiladkrthgad.exe
Uses 32bit PE files
Source: ngbtiladkrthgad.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: ngbtiladkrthgad.exe, type: SAMPLE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 0.0.ngbtiladkrthgad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 0.2.ngbtiladkrthgad.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@22/22@6/6
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00411250 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle, 0_2_00411250
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\MHHKCJV8.htm Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4276:120:WilError_03
Source: ngbtiladkrthgad.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: uaiwlfus2.0.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: ngbtiladkrthgad.exe Virustotal: Detection: 75%
Source: ngbtiladkrthgad.exe ReversingLabs: Detection: 71%
Source: unknown Process created: C:\Users\user\Desktop\ngbtiladkrthgad.exe "C:\Users\user\Desktop\ngbtiladkrthgad.exe"
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1892,i,7460351053640162327,6554442286005526848,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2444 /prefetch:3
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\o89zu" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 11
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\o89zu" & exit Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1892,i,7460351053640162327,6554442286005526848,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2444 /prefetch:3 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 11 Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: ngbtiladkrthgad.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ngbtiladkrthgad.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ngbtiladkrthgad.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ngbtiladkrthgad.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ngbtiladkrthgad.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004108E0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004108E0
PE file contains sections with non-standard names
Source: ngbtiladkrthgad.exe Static PE information: section name: .00cfg
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004108E0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004108E0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found decision node followed by non-executed suspicious APIs
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Evasive API call chain: GetSystemTime,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\timeout.exe TID: 7612 Thread sleep count: 96 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00414E70 wsprintfA,FindFirstFileA,DeleteFileA,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose, 0_2_00414E70
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00407210 ExpandEnvironmentStringsA,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,CopyFileA,DeleteFileA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose, 0_2_00407210
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040B6B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindClose, 0_2_0040B6B0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00415EB0 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindClose, 0_2_00415EB0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00408360 FindFirstFileA,CopyFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindClose, 0_2_00408360
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00413FD0 wsprintfA,FindFirstFileA,FindNextFileA,strlen,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose, 0_2_00413FD0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004013F0 FindFirstFileA,FindClose,FindNextFileA,strlen,FindFirstFileA,DeleteFileA,FindNextFileA,CopyFileA,CopyFileA,DeleteFileA,FindClose, 0_2_004013F0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00413580 wsprintfA,FindFirstFileA,memset,memset,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindClose, 0_2_00413580
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004097B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA, 0_2_004097B0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040ACD0 wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,lstrlenA,DeleteFileA,CopyFileA,FindClose, 0_2_0040ACD0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00408C90 lstrcpyA,lstrcatA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose,FindClose,DeleteFileA,_invalid_parameter_noinfo_noreturn, 0_2_00408C90
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00414950 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,strlen,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 0_2_00414950
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00409560 ??2@YAPAXI@Z,??2@YAPAXI@Z,_invalid_parameter_noinfo_noreturn,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA, 0_2_00409560
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00413AF0 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 0_2_00413AF0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040FDD0 GetSystemInfo,wsprintfA, 0_2_0040FDD0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW<=
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_004108E0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004108E0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040F470 CloseHandle,lstrlenA,GetProcessHeap,RtlFreeHeap,GetProcessHeap,HeapAlloc,lstrcpyA, 0_2_0040F470

HIPS / PFW / Operating System Protection Evasion
barindex
Searches for specific processes (likely to inject)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00411250 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle, 0_2_00411250
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00411310 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle, 0_2_00411310
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\o89zu" & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 11 Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,GetLocaleInfoA,LocalFree, 0_2_0040FC20
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0041BAA0 GetLocalTime,SystemTimeToFileTime,FileTimeToSystemTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 0_2_0041BAA0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_00417210 EntryPoint,lstrlenW,GetWindowsDirectoryW,GetComputerNameW,GetFullPathNameA,GetUserNameW,GetFileType,GetModuleFileNameA,GetTempPathW, 0_2_00417210
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Code function: 0_2_0040FBC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 0_2_0040FBC0
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: ngbtiladkrthgad.exe PID: 7304, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: ngbtiladkrthgad.exe, 00000000.00000002.1824047541.00000000031D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum\wallets\
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: exodus.conf.json
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ElectrumLTC
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: ngbtiladkrthgad.exe, 00000000.00000003.1321478371.0000000000665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: lgcnhelpchnceeipipijaljkblbcobl|1|1|1|Tronium|1|pnndplcbkakcplkjnolgbkdgjikjednm|1|0|0|Trust Wallet|1|egjidjbpglichdcondbcbdnbeeppgdph|1|0|0|Exodus Web3 Wallet|1|aholpfdialjgjfhomihkjbmgjidlcdno|1|0|0|Braavos|1|jnlgamecbpmbajjfhmmmlhejkemejdma|1|0|0|Enkrypt|1|kkpllkodjeloidieedojogacfhpaihoh|1|0|0|OKX Web3 Wallet|1|mcohilncbfahbmgdjkbpemcciiolgcge|1|0|0|Sender|1|epapihdplajcdnnkdeiahlgigofloibg|1|0|0|Hashpack|1|gjagmgiddbbciopjhllkdnddhcglnemk|1|0|0|GeroWallet|1|bgpipimickeadkjlklgciifhnalhdjhe|1|0|0|Pontem Wallet|1|phkbamefinggmakgklpkljjmgibohnba|1|0|0|Finnie|1|cjmkndjhnagcfbpiemnkdpomccnjblmj|1|0|0|Leap Terra|1|aijcbedoijmgnlmjeegjaglmepbmpkpi|1|0|0|Microsoft AutoFill|0|fiedbfgcleddlbcmgdigjgdfcggjcion|1|0|0|Bitwarden|0|nngceckbapebfimnlniiiahkandclblb|1|0|0|KeePass Tusk|0|fmhmiaejopepamlcjkncpgpdjichnecm|1|0|0|KeePassXC-Browser|0|oboonakemofpalcgghocfoadofidjkkk|1|0|0|Rise - Aptos Wallet|1|hbbgbephgojikajhfbomhlmmollphcad|1|0|0|Rainbow Wallet|1|opfgelmcmbiajamepnmloijbpoleiama|1|0|0|Nightly|1|fiikommddbeccaoicoejoniammnalkfa|1|0|0|Ecto Wallet|1|bgjogpoidejdemgoochpnkmdjpocgkha|1|0|0|Coinhub|1|jgaaimajipbpdogpdglhaphldakikgef|1|0|0|Leap Cosmos Wallet|1|fcfcfllfndlomdhbehjjcoimbgofdncg|1|0|0|MultiversX DeFi Wallet|1|dngmlblcodfobpdpecaadgfbcggfjfnm|1|0|0|Frontier Wallet|1|kppfdiipphfccemcignhifpjkapfbihd|1|0|0|SafePal|1|lgmpcpglpngdoalbgeoldeajfclnhafa|1|0|0|SubWallet - Polkadot Wallet|1|onhogfjeacnfoofkfgppdlbmlmnplgbn|1|0|0|Fluvi Wallet|1|mmmjbcfofconkannjonfmjjajpllddbg|1|0|0|Glass Wallet - Sui Wallet|1|loinekcabhlmhjjbocijdoimmejangoa|1|0|0|Morphis Wallet|1|heefohaffomkkkphnlpohglngmbcclhi|1|0|0|Xverse Wallet|1|idnnbdplmphpflfnlkomgpfbpcgelopg|1|0|0|Compass Wallet for Sei|1|anokgmphncpekkhclmingpimjmcooifb|1|0|0|HAVAH Wallet|1|cnncmdhjacpkmjmkcafchppbnpnhdmon|1|0|0|Elli - Sui Wallet|1|ocjdpmoallmgmjbbogfiiaofphbjgchh|1|0|0|Venom Wallet|1|ojggmchlghnjlapmfbnjholfjkiidbch|1|0|0|Pulse Wallet Chromium|1|ciojocpkclfflombbcfigcijjcbkmhaf|1|0|0|Magic Eden Wallet|1|mkpegjkblkkefacfnmkajcjmabijhclg|1|0|0|Backpack Wallet|1|aflkmfhebedbjioipglgcbcmnbpgliof|1|0|0|Tonkeeper Wallet|1|omaabbefbmiijedngplfjmnooppbclkk|1|0|0|OpenMask Wallet|1|penjlddjkjgpnkllboccdgccekpkcbin|1|0|0|SafePal Wallet|1|apenkfbbpmhihehmihndmmcdanacolnh|1|0|0|Bitget Wallet|1|jiidiaalihmmhddjgbnbgdfflelocpak|1|0|0|TON Wallet|1|nphplpgoakhhjchkkhmiggakijnkhfnd|1|0|0|MyTonWallet|1|fldfpgipfncgnd
Source: ngbtiladkrthgad.exe, 00000000.00000002.1824047541.00000000031D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: *wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Source: ngbtiladkrthgad.exe, 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\key4.db Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\key4.db Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000000.00000002.1823139867.000000000065B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ngbtiladkrthgad.exe PID: 7304, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\Desktop\ngbtiladkrthgad.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: ngbtiladkrthgad.exe PID: 7304, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1637340 Sample: ngbtiladkrthgad.exe Startdate: 13/03/2025 Architecture: WINDOWS Score: 100 30 s.p.formaxprime.co.uk 2->30 32 t.me 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 5 other signatures 2->48 8 ngbtiladkrthgad.exe 28 2->8         started        signatures3 process4 dnsIp5 34 s.p.formaxprime.co.uk 78.47.63.132, 443, 49720, 49723 HETZNER-ASDE Germany 8->34 36 t.me 149.154.167.99, 443, 49719 TELEGRAMRU United Kingdom 8->36 38 127.0.0.1 unknown unknown 8->38 50 Attempt to bypass Chrome Application-Bound Encryption 8->50 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 8->52 54 Found many strings related to Crypto-Wallets (likely being stolen) 8->54 56 5 other signatures 8->56 12 chrome.exe 8->12         started        15 cmd.exe 1 8->15         started        signatures6 process7 dnsIp8 40 192.168.2.4, 138, 443, 49190 unknown unknown 12->40 17 chrome.exe 12->17         started        20 conhost.exe 15->20         started        22 timeout.exe 1 15->22         started        process9 dnsIp10 24 plus.l.google.com 142.250.185.174, 443, 49762 GOOGLEUS United States 17->24 26 www.google.com 216.58.206.36, 443, 49741, 49742 GOOGLEUS United States 17->26 28 apis.google.com 17->28
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU false
78.47.63.132
 s.p.formaxprime.co.uk Germany
24940 HETZNER-ASDE true
216.58.206.36
 www.google.com United States
15169 GOOGLEUS false
142.250.185.174
 plus.l.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.4
127.0.0.1

Contacted Domains

Name IP Active
s.p.formaxprime.co.uk 78.47.63.132 true
plus.l.google.com 142.250.185.174 true
t.me 149.154.167.99 true
www.google.com 216.58.206.36 true
apis.google.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://t.me/g_etcontent false
    		high
    https://www.google.com/async/newtab_promos false
      		high
      https://www.google.com/async/ddljson?async=ntp:2 false
        		high
        https://steamcommunity.com/profiles/76561199832267488 false
          		high
          https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0 false
            		high
            https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE false
              		high